sleuthkit-users

[sleuthkit-users] Analyzing FreeBSD Partition

[Brooks, P. <pre...@tw...>]

Hey All,
    I need some help trying to get sleuthkit to read an image pulled
from a (reportedly) FreeBSD system.  The image was taken using dd of
/dev/hda1.  Attempts to point autopsy at the image file using ufs,
freebsd, and openbsd, all fail reporting that the image is not those
filesystem types.  After reading volume 12 of the informer, I decided to
try ripping the 4.2BSD image out:
=20
mmls output of the resulting image file:
=20
 /usr/local/sleuthkit/bin/mmls -t bsd hda1.img          BSD Disk Label
Sector: 1
Units are in 512-byte sectors
=20
     Slot    Start        End          Length       Description
00:  -----   0000000000   0000000062   0000000063   Unallocated
01:  01      0000000063   0000262206   0000262144   Swap (0x01)
02:  02      0000000063   0019535039   0019534977   Unused (0x00)
03:  00      0000262207   0019535039   0019272833   4.2BSD (0x07)
=20
=20
Using the following dd command: dd if=3Dhda1.img bs=3D512 =
of=3Dfreebsd.dd
skip=3D262207 count=3D19272833
=20
however, the resulting freebsd.dd image has the same failures as the
previous.  I have looked for any other references to the 4.2BSD but
haven't found anything in particular about it.  Am I missing something?
Any help will be greatly appreciated.
=20
Prentis Brooks
Enterprise Security Technical Manager
office: 704-731-3408=20
AIM: TWCPaladin=20
email: pre...@tw...
=20

Re: [sleuthkit-users] Analyzing FreeBSD Partition

[Barry J. G. <bg...@im...>]

On Fri, 2006-02-24 at 10:07 -0500, Brooks, Prentis wrote:

> however, the resulting freebsd.dd image has the same failures as the
> previous.  I have looked for any other references to the 4.2BSD but
> haven't found anything in particular about it.  Am I missing
> something?  Any help will be greatly appreciated.

Hi Prentis,

I'm going to hazard a guess here... It looks like the file hda1.img is
an image created via dd of a "freebsd partition", perhaps identified by
linux fdisk (or sfdisk, etc.) In other words "not the whole disk".

Your mmls command shows you the disk label found in that partition, but
the offsets given to the freebsd filesystem are relative to the *disk*
(hda) not the partition (hda1).  So in trying to carve out the
filesystem, you are passing an offset that is wrong.

That is a *guess*.

Have you used xxd (or other viewer) to look at the image and the results
of your attempted carve?  Any "unix labelufs" strings?
 
-- 
/***************************************
Special Agent Barry J. Grundy
NASA Office of Inspector General
Computer Crimes Division 
Goddard Space Flight Center
Code 190
Greenbelt Rd.
Greenbelt, MD 20771
(301)286-3358
**************************************/