Re: [sleuthkit-users] (no subject)

[Angus M. <an...@n-...>]

The physical/logical issue sounds fairly typical of a lot of disks that I've
examined.

Could you post the results from sleuthkit's "mmls -t dos -i raw <imagefile>" here ? 

We might be able to give some more specific help.

On Tue Mar 28 14:00 , gim...@we... sent:

>On Mon, 27 Mar 2006 10:14:23 -0500
>Carlton Foster c.a...@LA...> wrote:
>
>> I was asked to create an image of a system a couple of weeks ago but 
>> told not to investigate it.  I used dcfldd over netcat on a crossover 
>> cable to image the system.  I created MD5's of the source and image, 
>> and both matched.
>> 
>> I did a physical image, not logical.
>> 
>> Today, I have been asked to investigate the image.  However, the 
>> partition table appears bad.
>> 
>> I am getting warnings from fdisk saying Partition 1 has different 
>> logical/physical endings.  Then Partition 2 has different beginnings 
>> and endings.  I can't figure out how to get the logical images 
>> extracted, and we no longer have access to the source system.
>> 
>> Can anyone provide any help?
>> -- 
>
>Try out this one: http://www.cgsecurity.org/wiki/TestDisk
>
>From the summary:
>
>"If you have missing partitions or a completely empty Partition Table,
>TestDisk can search for partitions and create a new Table or even a new
>MBR if necessary."
>
>regards
>
>
>-------------------------------------------------------
>This SF.Net email is sponsored by xPML, a groundbreaking scripting language
>that extends applications into web and mobile media. Attend the live webcast
>and join the prime developer group breaking into this new coding territory!
>http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
>_______________________________________________
>sleuthkit-users mailing list
>https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>http://www.sleuthkit.org