[sleuthkit-users] Problems with Sorter

[Brent K. <bre...@gm...>]

I have a dd image of an NTFS disk.  I'm using the most recent build of TSK
under Cygwin on a XP machine.

When I run sorter on the dd image and specify "-f ntfs", I get back an error
message "Incorrect file system type (-f ntfs)".

Running fsstat on the same dd image returns recognition that this image is
indeed an NTFS file system.

Any suggestions?

For reference, here is the complete sorter command I am running:

>> sorter -d c:\\output -h -s -n /usr/local/nsrl/NSRLFile.txt -m "E:/" -f
ntfs -i raw /usr/local/images/analysis.dd

By the way, from within Autopsy the same error is generated.

Many thanks.

Brent