sleuthkit-users

[sleuthkit-users] Previewing drives

[Jon N. <qu...@li...>]

Does anyone know if using the device name (e.g., /dev/hda1) as the image
file for Autopsy will alter the drive?

I tested this with a floppy and the MD5 did not change.  I was going to d=
o
some more intensive testing, but I don't want to re-invent the wheel.

One reason I would want to do this is to eliminate large drives from a
case without having to image them, while still getting the functionality
of Autopsy.

TIA,

Jon

--=20
Trooper Jon S. Nelson, Linux Certified Admin., CCNA
Pa. State Police, Bureau of Criminal Investigation
Computer Crimes Unit
Work: 610.344.4471 Cell/Page: 866.284.1603
jon...@st...

Re: [sleuthkit-users] Previewing drives

[Brian C. <ca...@sl...>]

On Feb 25, 2004, at 12:37 PM, Jon Nelson wrote:

> Does anyone know if using the device name (e.g., /dev/hda1) as the 
> image
> file for Autopsy will alter the drive?


It shouldn't.  The Sleuth Kit opens the image files (or devices) 
read-only so it will not make any changes.  If the disk is mounted on a 
live system, then the disk maybe changed by loading the processes for 
The Sleuth Kit or Autopsy, but that would be the OS changing the disk 
because any process is running.

brian

Re: [sleuthkit-users] Previewing drives

[Enda C. <en...@co...>]

 "Brian Carrier"
>
> On Feb 25, 2004, at 12:37 PM, Jon Nelson wrote:
>
> > Does anyone know if using the device name (e.g., /dev/hda1) as the
> > image
> > file for Autopsy will alter the drive?
>
>
> It shouldn't.  The Sleuth Kit opens the image files (or devices)
> read-only so it will not make any changes.  If the disk is mounted on a
> live system, then the disk maybe changed by loading the processes for
> The Sleuth Kit or Autopsy, but that would be the OS changing the disk
> because any process is running.

An exception being Reiser perhaps? where the journal gets modified even on
read only mounts? Or does the SluethKit have its own filesystem drivers
rather than the stock system ones?

 -Enda.

Re: [sleuthkit-users] Previewing drives

[Brian C. <ca...@sl...>]

>> It shouldn't.  The Sleuth Kit opens the image files (or devices)
>> read-only so it will not make any changes.  If the disk is mounted on 
>> a
>> live system, then the disk maybe changed by loading the processes for
>> The Sleuth Kit or Autopsy, but that would be the OS changing the disk
>> because any process is running.
>
> An exception being Reiser perhaps? where the journal gets modified 
> even on
> read only mounts? Or does the SluethKit have its own filesystem drivers
> rather than the stock system ones?

Well, TSK/Autopsy doesn't support Reiser...  But, TSK doesn't rely on 
any kernel drivers (which is why you can, for example, examine NTFS and 
EXT3FS on a Solaris box).  Therefore, the bug in the Linux kernel with 
respect to EXT3FS (and Reiser) doesn't apply to TSK.

brian