sleuthkit-users — List to discuss Autopsy and The Sleuth Kit.

Re: [sleuthkit-users] RE: Sleuthkit install problem

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On May 26, 2004, at 3:16 PM, Angus Marshall wrote:
> Ok - ignore EVERYTHING I have said on this issue up to this point. 
> Having done
> some more work on it -  it looks (to me - and I could be wrong, I 
> frequently
> am) like the problem is being caused by the definition of syscall5 
> moving
> into a different header file. Adding a
>
> #include <linux/unistd.h>
>
> to mylseek.c immediately after the #include <syscall.h> line
> seems to work for me (testing on SK1.67 currently).

So, to confirm.  You are using the original makedefs and fs_tools.h 
file.  All you did was add linux/unistd.h to mylseek.c?

brian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAtXm4OK1gLsdFTIsRAldYAJ9C11lWaM6BDf6cYXhae0ZTDoULSQCfbaFp
hKEMe/BRtGfS44dM94umez0=
=7gum
-----END PGP SIGNATURE-----

Fwd: Re: [sleuthkit-users] Tool acceptance (was RE: Sleuthkit install problem)

[Angus M. <an...@n-...>]

<sigh> - I *must* learn what the "Reply to all" button does ;-) 

Re: [sleuthkit-users] RE: Sleuthkit install problem

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> Where does one find out what has been tested and accepted as far as 
> linux forensics go?

Where does one find out what has been tested and accepted as far as 
windows-based forensics goes?  What does it mean to be accepted?  What 
does it mean to not be accepted?  What tools are not accepted?  (I'm 
still waiting for someone to start making a list of tools that have 
been determined to be not accepted.)

> I just intalled the 2.6 kernel, and have never thought that its use 
> might not be validated as of yet. (Good thing I am still only 
> "playing").

This brings up a good point that it is more than just the analysis 
software that needs to be "tested and validated".  All software relies 
on the operating system, which changes with each service pack and 
patch. The version of libraries is also important.  Is each version of 
Windows-based software "tested and validated" with each service pack 
and combination of patches?   Is each version of Linux-based software 
tested with each patch and version of libc?

There are some software companies that focus on court acceptance, but 
it is not clear (to me at least) what that means.  If being accepted is 
difficult, then what tools have failed to pass the test?  Where is the 
bar?  If you look at the Daubert guidelines for entering technical 
evidence into a US court, I don't think any of the computer forensic 
tools can currently meet them.  Error rates?  Published procedures?  
What does it mean to test a tool for NTFS file systems?

The lack of answers for these questions is partly why I have started to 
release the test images on dftt.sf.net so that there is some basic 
concept of tool testing.  These images have found bugs in all of the 
popular Windows-based forensic tools, even though they were "accepted".

I agree with you that in the short run, it could be safer to stick with 
the Windows-based tools because they have an impressive court record.  
I understand the concern, but I'm more worried about the bigger 
picture.  If it is not clear where the acceptance bar is, who knows if 
the currently accepted tools will always be considered accepted?

> People (I) have a tendency to go for the latest and greatest...but 
> sometimes it takes years for new practices or systems to become 
> accepted by the forensic community.

Maybe.  I think it takes a long time for a tool company to be accepted, 
but when the latest major version comes out, which may have included an 
entire rewrite of the internal code, people are fairly quick to accept 
it.

>   I don't want to be the guy on the stand explaining why I am the only 
> one who uses a particular practice.  That may be a little extreme 
> since I am aware, and practice, personal validation of tools prior to 
> enlisting their use full time.  Just humor me a little with some 
> ideas.  It's easy to pay $2500 for a windows based utility with 
> corporate backing and full time courtroom experts who will fly out on 
> your behalf for a nominal fee.

I can understand that and if that is what you are looking for, then the 
commercial tools (including the Linux-based SMART) are probably a 
better option.  I would not phrase the support issue as Linux versus 
Windows, I would phrase it as free versus commercial.

I think, that open source tools are the better option in the long run 
(even if they are commercial).  It makes more sense to me that any 
person with programming and file system experience can read through the 
code and explain how it works to the court instead of relying on a 
vendor-sponsored expert.

thanks,
brian




-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAtXlBOK1gLsdFTIsRApSrAJ91zC85Z9fEtcUoDHjuqeMp8HMM/QCfTf1G
22byiZ4fR+n8k2TO/5mGo2w=
=KrNh
-----END PGP SIGNATURE-----

RE: [sleuthkit-users] RE: Sleuthkit install problem

[Chris P. <po...@na...>]

That brings up a good point....

Where does one find out what has been tested and accepted as far as =
linux forensics go?  I just intalled the 2.6 kernel, and have never =
thought that its use might not be validated as of yet. (Good thing I am =
still only "playing").  People (I) have a tendency to go for the latest =
and greatest...but sometimes it takes years for new practices or systems =
to become accepted by the forensic community.  I don't want to be the =
guy on the stand explaining why I am the only one who uses a particular =
practice.  That may be a little extreme since I am aware, and practice, =
personal validation of tools prior to enlisting their use full time.  =
Just humor me a little with some ideas.  It's easy to pay $2500 for a =
windows based utility with corporate backing and full time courtroom =
experts who will fly out on your behalf for a nominal fee. =20


--
Regards,=20

Chris Poldervaart, Investigator
Natrona County Sheriff's Office
201 N David St Casper, WY 82601
307-235-9282    po...@na... <mailto:po...@na...> =20

CONFIDENTIALITY NOTICE: This e-mail message including attachments, if =
any, is intended only for the person or entity to which it is addressed =
and may contain confidential and/or privileged material. Any =
unauthorized review, use, disclosure or distribution is prohibited. If =
you are not the intended recipient, please contact the sender by reply =
e-mail and destroy all copies of the original message. If you are the =
intended recipient but do not wish to receive communications through =
this medium, please so advise the sender immediately.=20


-----Original Message-----
From: sle...@li...
[mailto:sle...@li...]On Behalf Of Angus
Marshall
Sent: Wednesday, May 26, 2004 2:17 PM
To: Brian Carrier
Cc: sle...@li...
Subject: Re: [sleuthkit-users] RE: Sleuthkit install problem


On Wednesday 26 May 2004 09:11, Angus Marshall wrote:

Ok - ignore EVERYTHING I have said on this issue up to this point. =
Having done=20
some more work on it -  it looks (to me - and I could be wrong, I =
frequently=20
am) like the problem is being caused by the definition of syscall5 =
moving=20
into a different header file. Adding a

#include <linux/unistd.h>=20

to mylseek.c immediately after the #include <syscall.h> line
seems to work for me (testing on SK1.67 currently).

I get a successful compilation after doing this and a good dls on a 8Gb=20
partition - no errors visible at all.

This still uses the custom lseek, which I prefer since it has been =
accepted in=20
court, unlike the Linux 2.6 kernel.




-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g. =

Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id=3D3149&alloc_id=3D8166&op=3Dclick
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org


__________________________________________________________________
<< ella for Spam Control >> has removed Spam messages and set aside =
Newsletters for me
You can use it too - and it's FREE!  http://www.ellaforspam.com

Re: [sleuthkit-users] RE: Sleuthkit install problem

[Angus M. <an...@n-...>]

On Wednesday 26 May 2004 09:11, Angus Marshall wrote:

Ok - ignore EVERYTHING I have said on this issue up to this point. Having done 
some more work on it -  it looks (to me - and I could be wrong, I frequently 
am) like the problem is being caused by the definition of syscall5 moving 
into a different header file. Adding a

#include <linux/unistd.h> 

to mylseek.c immediately after the #include <syscall.h> line
seems to work for me (testing on SK1.67 currently).

I get a successful compilation after doing this and a good dls on a 8Gb 
partition - no errors visible at all.

This still uses the custom lseek, which I prefer since it has been accepted in 
court, unlike the Linux 2.6 kernel.

RE: [sleuthkit-users] RE: Sleuthkit install problem

[Chris P. <po...@na...>]

Brian,=20

I issued your dls command on a 40GB NTFS partition and received no =
errors.  I have to admit that I am on a different machine than the one I =
started with, so I will try it again at work when I can (assuming the =
install works there).

Chris.


-----Original Message-----
From:	sle...@li... on behalf of Brian =
Carrier
Sent:	Tue 5/25/2004 7:10 PM
To:	Angus Marshall
Cc:	sle...@li...
Subject:	Re: [sleuthkit-users] RE: Sleuthkit install problem
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On May 25, 2004, at 6:11 PM, Angus Marshall wrote:
> Not sure which is the case - but here's a thought (don't scream) - if
> src/makedefs is modified to change the "-DLINUX2" to read =
"-DOPENBSD3",
> sleuthkit seems to compile just fine.

What happens when you examine a >2GB disk?  The custom lseek was added=20
in TCT because the lseek with Linux did not seek beyond the 2GB limit. =20
So, I guess the test is to see if the syscall was fixed and it now=20
works for large files or that change has reverted the code back to the=20
limited version.

Test it with the following:

# dls -e -f FILESYSTEM /dev/hdaX > /dev/null

on a large partition.

thanks,
brian



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAs+6DOK1gLsdFTIsRAmtiAJ9AO/4nNDvRD0qFlw1VNBr+p95c3gCfVa76
FOVV9Xg4AMHBkRBFI0ASINg=3D
=3DuUaL
-----END PGP SIGNATURE-----



-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g. =

Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id=3D3149&alloc_id=3D8166&op=3Dclick
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

Re: [sleuthkit-users] RE: Sleuthkit install problem

[Angus M. <an...@n-...>]

On Wednesday 26 May 2004 02:10, you wrote:
> On May 25, 2004, at 6:11 PM, Angus Marshall wrote:
> > Not sure which is the case - but here's a thought (don't scream) - if
> > src/makedefs is modified to change the "-DLINUX2" to read "-DOPENBSD3",
> > sleuthkit seems to compile just fine.
>
> What happens when you examine a >2GB disk?  The custom lseek was added
> in TCT because the lseek with Linux did not seek beyond the 2GB limit.
> So, I guess the test is to see if the syscall was fixed and it now
> works for large files or that change has reverted the code back to the
> limited version.
>
> Test it with the following:
>
> # dls -e -f FILESYSTEM /dev/hdaX > /dev/null
>
> on a large partition.
>
> thanks,
> brian

Thanks Brian - I'll try it this evening when I have created a fresh image for 
testing. Presumably the error message will be obvious if it doesn't work ?

Re: [sleuthkit-users] RE: Sleuthkit install problem

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On May 25, 2004, at 6:11 PM, Angus Marshall wrote:
> Not sure which is the case - but here's a thought (don't scream) - if
> src/makedefs is modified to change the "-DLINUX2" to read "-DOPENBSD3",
> sleuthkit seems to compile just fine.

What happens when you examine a >2GB disk?  The custom lseek was added 
in TCT because the lseek with Linux did not seek beyond the 2GB limit.  
So, I guess the test is to see if the syscall was fixed and it now 
works for large files or that change has reverted the code back to the 
limited version.

Test it with the following:

# dls -e -f FILESYSTEM /dev/hdaX > /dev/null

on a large partition.

thanks,
brian



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAs+6DOK1gLsdFTIsRAmtiAJ9AO/4nNDvRD0qFlw1VNBr+p95c3gCfVa76
FOVV9Xg4AMHBkRBFI0ASINg=
=uUaL
-----END PGP SIGNATURE-----

Re: FW: Re: [sleuthkit-users] RE: Sleuthkit install problem

[Angus M. <an...@n-...>]

On Wednesday 26 May 2004 00:11, Angus Marshall wrote:
> In-Reply-To: <B05...@sl...>
> References: <B05...@sl...>
>
> Brian, if I read the code correctly, this affects fs_tools.h and mm_tools.h
> and selects the OS-provided functions instead of the SK provided functions.
> Since SK seems to compile OK - could it be that Linux 2.6 now supports the
> functions better than 2.2/2.4 used to ? Of course, it looks like it will
> cause some problems with filesystem types, but maybe the workaround is for
> us Linux 2.6ers to patch src/fstools/fs_tools.h to make the LSEEK
> definition go to lseek instead of mylseek ?

OK - just tried tweaking src/fstools/fs_tools.h and changed the LINUX section 
to the following : 

/*
  * Linux 2.whatever. We'll see how stable the interfaces are.
  */
#if defined(LINUX2)
#define SUPPORTED
#include <linux/types.h>
#define HAVE_LLSEEK
#define LSEEK           lseek
#define OFF_T           off_t
#define STRTOUL         strtoul
#define DADDR_T         daddr_t
#define DEF_FSTYPE              "linux-ext2"
#define HAVE_TIMEZONE   1
#endif /* LINUX */

This gives a clean compile (syscall5 is not producing the error btw - it's all 
lseek related as far as I can see), but I don't know if it actually works.

I'm going to go to bed to try to sleep (I will not hack other people's code at 
1:00 a.m. I will not hack other people's code at 1:00 a.m. I will not hack 
other people's code at 1:00 a.m. I will not hack other people's code at 1:00 
a.m. I will not hack other people's code at 1:00 a.m. ;-) 

Looking forward to the flames in the morning.

FW: Re: [sleuthkit-users] RE: Sleuthkit install problem

[Angus M. <an...@n-...>]

In-Reply-To: <B05...@sl...>
References: <B05...@sl...>


It really is late here - I sent this to Brian without copying it to the list. 
Apologies.

--forwarded message begins--

From: Angus Marshall <an...@n-...>
To: Brian Carrier <ca...@sl...>

On Tuesday 25 May 2004 18:41, Brian Carrier wrote:
> On May 25, 2004, at 11:35 AM, Drew Fahey wrote:
> > The problem is not 64-bit HW.  I have the same problem on my laptop
> > with
> > Fedora Core 2 as well.  The problem is in the Kernel headers and with
> > util-linux.  The kernel headers need to have the syscall5 macro fixed
> > or
> > util-linux needs to be patched to not use llseek.
>
> So are you saying that this is a general problem with all applications
> that use llseek and  Fedora Core 2 and they are working on a solution
> or that TSK needs to be fixed for Fedora Core specific things?

Not sure which is the case - but here's a thought (don't scream) - if 
src/makedefs is modified to change the "-DLINUX2" to read "-DOPENBSD3", 
sleuthkit seems to compile just fine. What the implications of doing this are 
- I really don't know - it's 2 minutes to midnight here and I've just closed 
off two cases for delivery to the investigation team tomorrow, so my brain is 
pretty well fried anyway. 

Brian, if I read the code correctly, this affects fs_tools.h and mm_tools.h 
and selects the OS-provided functions instead of the SK provided functions. 
Since SK seems to compile OK - could it be that Linux 2.6 now supports the 
functions better than 2.2/2.4 used to ? Of course, it looks like it will 
cause some problems with filesystem types, but maybe the workaround is for us 
Linux 2.6ers to patch src/fstools/fs_tools.h to make the LSEEK definition go 
to lseek instead of mylseek ?

Is there a reference test that someone could perform to see if this would work 
?
(I run Linux 2.4 on my desktop workstation and have a choice of 2.4 or 2.6 on 
my laptop so I'm happy to check one against the other if someone can suggest 
a valid test set)

RE: [sleuthkit-users] RE: Sleuthkit install problem

[Chris P. <po...@na...>]

Anyone recommend a distro for forensics other than FC2, since I am =
obviously having probs with that.  I just installed the OS last night, =
and although I am not thrilled about downloading new isos and =
reinstalling, I really want to give linux forensics a try.

Chris.


__________________________________________________________________
<< ella for Spam Control >> has removed Spam messages and set aside =
Newsletters for me
You can use it too - and it's FREE!  http://www.ellaforspam.com

Re: [sleuthkit-users] RE: Sleuthkit install problem

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On May 25, 2004, at 11:35 AM, Drew Fahey wrote:

> The problem is not 64-bit HW.  I have the same problem on my laptop 
> with
> Fedora Core 2 as well.  The problem is in the Kernel headers and with
> util-linux.  The kernel headers need to have the syscall5 macro fixed 
> or
> util-linux needs to be patched to not use llseek.

So are you saying that this is a general problem with all applications 
that use llseek and  Fedora Core 2 and they are working on a solution 
or that TSK needs to be fixed for Fedora Core specific things?

thanks,
brian

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAs4UwOK1gLsdFTIsRAjMHAKCHwc8jlNhrrO79fkqJ8p07pixXzwCfWSjc
IUpYLnhUyna+cRtIB0IRXGY=
=zFia
-----END PGP SIGNATURE-----

[sleuthkit-users] RE: Sleuthkit install problem

[Drew F. <df...@e-...>]

The problem is not 64-bit HW.  I have the same problem on my laptop with
Fedora Core 2 as well.  The problem is in the Kernel headers and with
util-linux.  The kernel headers need to have the syscall5 macro fixed or
util-linux needs to be patched to not use llseek.

Drew

Re: [sleuthkit-users] Sleuthkit install problem

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On May 24, 2004, at 10:59 PM, Chris Poldervaart wrote:

> I have just created a fresh install of Fedora Core 2, and my first=20
> goal was to get sleuthkit and autopsy up and running.=A0 I am running=20=

> into problems with the install, and unfortunately I am a little rusty=20=

> on Linux.
>

it looks like you have 64-bit HW, which is not supported yet.  Some=20
other users have been looking into it, but I'm not sure what the status=20=

is.

brian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAsulKOK1gLsdFTIsRAi42AJ48+k2Gw8/7ll3CyUfbYEybKdlIqwCfaTZR
DEaqDH4Wd1Cc7XrWmXkZSOY=3D
=3DMwg0
-----END PGP SIGNATURE-----

[sleuthkit-users] Sleuthkit install problem

[Chris P. <po...@na...>]

I have just created a fresh install of Fedora Core 2, and my first goal =
was to get sleuthkit and autopsy up and running.  I am running into =
problems with the install, and unfortunately I am a little rusty on =
Linux.
Here is what I get:

# make
cd src/misc; make "CC=3Dgcc" MAKELEVEL=3D
make: Nothing to be done for `all'.
cd src/hashtools; make "CC=3Dgcc" MAKELEVEL=3D
make: Nothing to be done for `all'.
cd src/fstools; make "CC=3Dgcc" MAKELEVEL=3D
gcc -DLINUX2 -D_FILE_OFFSET_BITS=3D64 -D_LARGEFILE64_SOURCE =
-DVER=3D\"1.69\" -I../misc -O -Wall  -g   -c -o mylseek.o mylseek.c
mylseek.c:32: error: syntax error before "_llseek"
mylseek.c:37: warning: return type defaults to `int'
mylseek.c: In function `_syscall5':
mylseek.c:38: error: syntax error before '{' token
mylseek.c:42: error: syntax error before "ret"
mylseek.c:37: warning: `_syscall5' defined but not used
make: *** [mylseek.o] Error 1
make: *** [defs] Error 2
make: *** [no-perl] Error 2

Re: [sleuthkit-users] Windows port

[Brian C. <ca...@sl...>]

On 17 May 2004 07:30 PDT you wrote:



> Hi,

> 

> does anybody know where to find a cygwin build of the Sleuth Kit 1.69 or has

> some information about how to compile the kit for windows ?

>



It should  compile in CYGWIN with no problems.  I added some patches for SFU to the last release, but I was not able to test it or get confirmation from the anonymous person that sent in the patch.  



brian

[sleuthkit-users] Windows port

[<mu...@lo...>]

Hi,

does anybody know where to find a cygwin build of the Sleuth Kit 1.69 or has
some information about how to compile the kit for windows ?

Many thanks in advance

Marcus 

[sleuthkit-users] Penguins are attacking

[Rick M. <sch...@ya...>]

hey there , new to the list.

I have a real simple question.
 
does anyone know of a user manual for the Penguin Sleuth Kit...?
thanx a bunch.
Richard.

		
---------------------------------
Do you Yahoo!?
Yahoo! Movies - Buy advance tickets for 'Shrek 2' 

Re: [sleuthkit-users] Newbie Q - USB file formats

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On May 4, 2004, at 10:42 PM, myk wrote:

> I am trying to recover files from a USB key drive (Kingston Technology 
> DataTraveler 2.0) using autopsy 1.7 running in Knoppix STD.  Autopsy 
> tells me it doesn't recognize the file format (none of the FAT's nor 
> NTFS).  The USB drive was "quick" formatted on a Win2K machine.   What 
> am I doing wrong?  TIA.

What device name did you use to specify the USB drive?  Some keys have 
multiple partitions and you will need to specify the device for the 
partition and not the device for the entire key.

I was waiting to add disk support to version 2 of TSK, but I think I 
may add it sooner.

brian


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAmRbrOK1gLsdFTIsRApgqAJ4zGgdoM1xl8PGuBwv582GYLVYZsgCePExb
frd0xMMv4I15Vr8bFWaLl5c=
=jLB8
-----END PGP SIGNATURE-----

[sleuthkit-users] Newbie Q - USB file formats

[myk <myk...@co...>]

I am trying to recover files from a USB key drive (Kingston Technology 
DataTraveler 2.0) using autopsy 1.7 running in Knoppix STD.  Autopsy 
tells me it doesn't recognize the file format (none of the FAT's nor 
NTFS).  The USB drive was "quick" formatted on a Win2K machine.   What 
am I doing wrong?  TIA.

RE: [sleuthkit-users] Help I'm lost - problem Loading dd image

[Paul B. <pau...@ho...>]

This did the trick! I will go back and read all the Informer issues now.

Thank you so much.

>From: "Eagle Investigative Services, Inc. " <in...@ea...>
>To: "'Paul Braxton'" 
><pau...@ho...>,<sle...@li...>
>Subject: RE: [sleuthkit-users] Help I'm lost - problem Loading dd image
>Date: Sun, 25 Apr 2004 23:10:24 -0400
>
>Paul,
>
>The problem is most likely that you are trying to load an entire drive
>image. Just look back at some of my posts regarding the same issue.
>
>TSK will only accept a partition as input.
>
>You can find out how to extract the partition here:
>
>http://www.sleuthkit.org/informer/sleuthkit-informer-2.html#split
>
>Be sure to choose bs=512. Any other choice will result in hours of
>frustration - trust me.
>
>It's one of the only frustrating things about using Autopsy/Sleuthkit. But
>once you get schooled in knwoing you can only add partitions via Autopsy, 
>it
>becomes easier to swallow.
>
>Niall.
>
>
>
>-----Original Message-----
>From: sle...@li...
>[mailto:sle...@li...] On Behalf Of Paul
>Braxton
>Sent: Sunday, April 25, 2004 8:41 PM
>To: sle...@li...
>Subject: [sleuthkit-users] Help I'm lost - problem Loading dd image
>
>All,
>
>I've searched the archive and couldn't find an answer to my question. I am
>trying to load an image into autopsy and I'm getting 'filesystem type is 
>not
>linux-ext3'.
>
>I created the image with 'dd if=/dev/hda of=/dev/hdb1/testcase.img
>
>/dev/hda is not mounted, is a Redhat 9, ext3 filesystem, hard drive that 
>I'm
>trying to acquire, 20GB drive
>/dev/hdb1 is a disk which I have wiped, partitionioned and formated (mkfs)
>with ext2, 180GB drive
>
>I boot off the penguin sleuth bootable cd which is using autopsy 1.71. The
>problem could be when I use dd - are there any special flags I need to use?
>
>Any help would be great!
>
>_________________________________________________________________
>MSN Toolbar provides one-click access to Hotmail from any Web page - FREE
>download! http://toolbar.msn.com/go/onm00200413ave/direct/01/
>
>
>
>-------------------------------------------------------
>This SF.net email is sponsored by: The Robotic Monkeys at ThinkGeek
>For a limited time only, get FREE Ground shipping on all orders of $35
>or more. Hurry up and shop folks, this offer expires April 30th!
>http://www.thinkgeek.com/freeshipping/?cpg=12297
>_______________________________________________
>sleuthkit-users mailing list
>https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>http://www.sleuthkit.org
>

_________________________________________________________________
Get rid of annoying pop-up ads with the new MSN Toolbar – FREE! 
http://toolbar.msn.com/go/onm00200414ave/direct/01/

RE: [sleuthkit-users] Help I'm lost - problem Loading dd image

[Eagle I. S. I. <in...@ea...>]

Paul, 

The problem is most likely that you are trying to load an entire drive
image. Just look back at some of my posts regarding the same issue. 

TSK will only accept a partition as input. 

You can find out how to extract the partition here: 

http://www.sleuthkit.org/informer/sleuthkit-informer-2.html#split

Be sure to choose bs=512. Any other choice will result in hours of
frustration - trust me. 

It's one of the only frustrating things about using Autopsy/Sleuthkit. But
once you get schooled in knwoing you can only add partitions via Autopsy, it
becomes easier to swallow. 

Niall. 



-----Original Message-----
From: sle...@li...
[mailto:sle...@li...] On Behalf Of Paul
Braxton
Sent: Sunday, April 25, 2004 8:41 PM
To: sle...@li...
Subject: [sleuthkit-users] Help I'm lost - problem Loading dd image

All,

I've searched the archive and couldn't find an answer to my question. I am
trying to load an image into autopsy and I'm getting 'filesystem type is not
linux-ext3'.

I created the image with 'dd if=/dev/hda of=/dev/hdb1/testcase.img

/dev/hda is not mounted, is a Redhat 9, ext3 filesystem, hard drive that I'm
trying to acquire, 20GB drive
/dev/hdb1 is a disk which I have wiped, partitionioned and formated (mkfs)
with ext2, 180GB drive

I boot off the penguin sleuth bootable cd which is using autopsy 1.71. The
problem could be when I use dd - are there any special flags I need to use?

Any help would be great!

_________________________________________________________________
MSN Toolbar provides one-click access to Hotmail from any Web page - FREE
download! http://toolbar.msn.com/go/onm00200413ave/direct/01/



-------------------------------------------------------
This SF.net email is sponsored by: The Robotic Monkeys at ThinkGeek
For a limited time only, get FREE Ground shipping on all orders of $35
or more. Hurry up and shop folks, this offer expires April 30th!
http://www.thinkgeek.com/freeshipping/?cpg=12297
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

[sleuthkit-users] Help I'm lost - problem Loading dd image

[Paul B. <pau...@ho...>]

All,

I've searched the archive and couldn't find an answer to my question. I am 
trying to load an image into autopsy and I'm getting 'filesystem type is not 
linux-ext3'.

I created the image with 'dd if=/dev/hda of=/dev/hdb1/testcase.img

/dev/hda is not mounted, is a Redhat 9, ext3 filesystem, hard drive that I'm 
trying to acquire, 20GB drive
/dev/hdb1 is a disk which I have wiped, partitionioned and formated (mkfs) 
with ext2, 180GB drive

I boot off the penguin sleuth bootable cd which is using autopsy 1.71. The 
problem could
be when I use dd - are there any special flags I need to use?

Any help would be great!

_________________________________________________________________
MSN Toolbar provides one-click access to Hotmail from any Web page – FREE 
download! http://toolbar.msn.com/go/onm00200413ave/direct/01/

Re: [sleuthkit-users] Anyone in or around Atlanta???

[BruceG <gri...@be...>]

On Tuesday 20 April 2004 14:49, Rich Thompson wrote:
> Howdy all,
>
> Anyone in or around Atlanta to make an image for me???
>  I've got a very paranoid client who needs an image
> made for evidence perservation, but is unwilling to
> send me the machine or the drive via FedEx (I'm in
> Ohio).  So it has to be made locally.
>
> So anyone in Georgia to make a copy, let me know.
>
> Thx,
> Richard C. Thompson
> Applied Forensics
> www.apfor.com
> ri...@ap...
> (937) 218 1744

Marietta here, but have never made a copy - so I think you need someone with 
experience living in Atlanta.

[sleuthkit-users] Sleuth Kit 1.69 Release

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Version 1.69 of TSK is available:

www.sleuthkit.org/sleuthkit/download.php
MD5: 3479168ca94a3f75bbe545fae3d97ca6

Note that if you install Autopsy with this version, Autopsy will 
incorrectly complain that a more recent version exists.  I have added a 
bug report for that in autopsy.

The first bug is critical and everyone should upgrade.

Bug Fixes
o The last sector of a FAT file system may not have been viewable.
o The slack flag (-s) for 'icat' could produce too much data for FFS 
and EXT3FS file systems.
o One of the verbose messages for EXT2FS was printing to STDOUT instead 
of STDERR.

Major Updates
o More output for 'fsstat' and FAT file systems.
o Updated version of 'file' to 4.09.
o Changes to handling of raw and swap file system types

brian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAhacGOK1gLsdFTIsRAoKkAJ9GFTY1gYY7TTxeXuHrzbapRRI6LACbB6pI
SoLdRMKV8GFXVMiyhX9yDb8=
=SnXf
-----END PGP SIGNATURE-----