sleuthkit-users

[sleuthkit-users] Cannot Determine File System Type

[Slade G. <se...@ss...>]

 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

All,

I made three images of an EXT3 file system for examination. The
images completed with no errors, but when I try to add them in
Autopsy it says they are not an EXT file system. I am using a laptop
and both the drive being imaged, and the drive where the image is
stored are external HDD enclosures attached via USB. Any help would
be greatly appreciated.

Slade E. Griffin, GCIH, GCFA
Security Engineer

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1

iQA/AwUBRKkemP5Rxktn+1WcEQIV0gCeO9amhsmKWrKR5gYaOce/hG4ivwgAoPoW
GJNvrP4nyrTj1vcAqCOtYszk
=kb+G
-----END PGP SIGNATURE-----

Re: [sleuthkit-users] Cannot Determine File System Type

[Jean-Francois B. <jfb...@gm...>]

> I made three images of an EXT3 file system for examination. The
> images completed with no errors, but when I try to add them in
> Autopsy it says they are not an EXT file system. I am using a laptop
> and both the drive being imaged, and the drive where the image is
> stored are external HDD enclosures attached via USB. Any help would
> be greatly appreciated.

You can try "disktype" to detect the partitions properties of the images
(http://disktype.sourceforge.net/) if "mmls" don't give you usefull
output.
-- 
Jean-Francois BECKERS

Re: [sleuthkit-users] Cannot Determine File System Type

[farmer d. <far...@ya...>]

Hi Slade,

Can you provide your syntax for the commands you used
to create your image files (or the tools and any
options)?

You're certain you made logical images (of a file
system, and not of a physical device containing one or
more file systems), yes?

Can you copy and paste this;

xxd -s 1024 -l 512 your_image_file


regards,

farmerdude

http://www.forensicbootcd.com/




--- Slade Griffin <se...@ss...> wrote:
> All,
> 
> I made three images of an EXT3 file system for
> examination. The
> images completed with no errors, but when I try to
> add them in
> Autopsy it says they are not an EXT file system. I
> am using a laptop
> and both the drive being imaged, and the drive where
> the image is
> stored are external HDD enclosures attached via USB.
> Any help would
> be greatly appreciated.
> 
> Slade E. Griffin, GCIH, GCFA

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com