Re: [sleuthkit-users] Cannot do File Analysis

[Brian C. <ca...@sl...>]

On Jun 13, 2007, at 12:34 AM, Zaki Akhmad wrote:

> On 6/12/07, Brian Carrier <ca...@sl...> wrote:
>
>> When you imported them, did you properly choose whether they were
>> disk images or a volume image?   Choosing the wrong answer for that
>> will result in not being able to do the file analysis.
>
> I do several image test, but all of it didn't work. I try this image
> [1], the md5 test is correct. Not work. On this image I choose the
> disk type.

Floppy disks do not typically have partition tables and therefore  
they should be treated as partitions.  If that using that option in  
Autopsy does not work, then go to the 'bin' directory of your Sleuth  
Kit installation and type:

# fsstat image.dd

[replacing image.dd with the name of the image in scan24.zip -- I  
forget what its called]

brian


>
> Then I do dd image on my 2G partition, it didn't work either. I choose
> the partition type. Any hint? Where's the wrong side? Thank you for
> the attention.
>
>> brian
>
> -- 
> Zaki Akhmad
> [1] http://www.honeynet.org/scans/scan24/image.zip