Re: [sleuthkit-users] Error in sorter - what am I missing?

[Barry J. G. <bg...@im...>]

On Wed, 2006-04-19 at 21:41 +0800, Jennifer Smith wrote:

> but I am getting the error "Incorrect file system type (-f ntfs)

Hi Jennifer,

I'm not familiar with the dd image from the book you are talking about.
If it is a disk image, then you need to pass an offset to the filesystem
you want to analyze.

Run "mmls" on the dd file. Find the NTFS partition and use it's starting
sector for the "-o" option (offset to the filesystem).  Check the man
page for more info.

Barry

-- 
/***************************************
Special Agent Barry J. Grundy
NASA Office of Inspector General
Computer Crimes Division 
Goddard Space Flight Center
Code 190
Greenbelt Rd.
Greenbelt, MD 20771
(301)286-3358
**************************************/