[sleuthkit-users] Error in sorter - what am I missing?

[Jennifer S. <g33...@li...>]

Thanks for the help with the path.  I am now able to run sorter, but I am g=
etting an error that I don't understand.  I am running the following comman=
d (from the /sleuthkit-2.03/ directory):

perl ./bin/sorter -d [path where i want the information saved]/sorted -f nt=
fs [path where the image is]/file.dd

but I am getting the error "Incorrect file system type (-f ntfs)

If I try running it without the -f flag at all, it says "Missing file syste=
m type (and autodetect is not working)"

I determined that it was ntfs from the results I got from Autopsy, but just=
 in case, I also tried other types in the command, all to no avail.  Am I m=
issing something?

The .dd file that I am using is from the book _Real Digital Forensics_ (I n=
eeded one to practice on), and it worked (from what I can tell) in Autopsy.

I am pretty new to the Linux world of forensics tools, so I really apprecia=
te the guidance.  Thanks again for the help.

And Brian, I have _File System Forensics_, too, I'm just not quite to that =
level yet!  Although I have used it for reference :)

Thanks again,
gg

--=20
_______________________________________________
Check out the latest SMS services @ http://www.linuxmail.org
This allows you to send and receive SMS through your mailbox.

Powered by Outblaze