Re: [sleuthkit-users] DD images for sun

[farmer d. <far...@ya...>]

--- rob...@us... wrote:
> You might need: -t ufs
> 
> Linux *should* support reading UFS without any
> additional work needed.
> 

Depending upon your Linux system you _may_ need to
pass another option to your 'mount' command, and that
is of the UFS type.  'mount' defaults to the "old" UFS
type if you do not specify the type.  'man mount' is
your friend, and specifically you most likely may pass
"ufstype=sun" for UFS initialized by SunOS or Solaris
on the Sparc platform or "ufstype=sunx86" for the same
but on Intel architecture.  


> --- Bri...@kp... wrote:
> > They are straight DD images of each partition of  
> the
> drive copied accross 
> the network. 

Can you elaborate?  Take each drive and share
verbosely what you did, and command syntax if you
remember.  This would allow everyone to help much
faster and minimize the speculation that results from
lack of knowledge about variables.



> I am using autopsy to perform the
> analysis, but it does not 
> appear to be able to ascertaing the file system...

Have you substantiated this with any other forensic
program, be it SMART, FTK, etc.?


regards,

farmerdude


 
____________________________________________________________________________________
Food fight? Enjoy some healthy debate 
in the Yahoo! Answers Food & Drink Q&A.
http://answers.yahoo.com/dir/?link=list&sid=396545367