sleuthkit-users

[sleuthkit-users] Doubt on file formats

[Pradeep M <pra...@gm...>]

               I am new to Linux and I have been assigned a task of
recovering data from a floppy. I am also new to Autopsy. Actually when
 I went through the Honeynet site I saw similar exercises. In one of
the scans they had a challenge of recovering files from a floppy. They
gave some image.zip
(http://www.honeynet.org/scans/scan24/image.zip)  which contains a
image and we have to recover deleted files from it. What I did was I
used the same image and recovered deleted files by using auotpsy. My
problem is I dont understand the file format of the image.
              When I created files in a floppy and deleted it, I am
not able to recover it using autopsy. Autopsy could not recognise the
file format. Can anyone help to solve this problem?

Pradeep

Re: [sleuthkit-users] Doubt on file formats

[Brian C. <ca...@sl...>]

If you 'dd' the floppy, you should import it into Autopsy as a volume 
(there is typically no partition table on floppies).  Autopsy should 
then detect it as FAT12.

brian


On Apr 7, 2005, at 7:29 AM, Pradeep M wrote:

>                I am new to Linux and I have been assigned a task of
> recovering data from a floppy. I am also new to Autopsy. Actually when
>  I went through the Honeynet site I saw similar exercises. In one of
> the scans they had a challenge of recovering files from a floppy. They
> gave some image.zip
> (http://www.honeynet.org/scans/scan24/image.zip)  which contains a
> image and we have to recover deleted files from it. What I did was I
> used the same image and recovered deleted files by using auotpsy. My
> problem is I dont understand the file format of the image.
>               When I created files in a floppy and deleted it, I am
> not able to recover it using autopsy. Autopsy could not recognise the
> file format. Can anyone help to solve this problem?

Re: [sleuthkit-users] Doubt on file formats

[Barry J. G. <bg...@im...>]

On Thu, 2005-04-07 at 17:59 +0530, Pradeep M wrote:
>  My
> problem is I dont understand the file format of the image.

I'm not completely sure I understand your question.  The "file format"
of an image to be used with TSK/Autopsy is a "raw" image.  In other
words, the floppy was acquired with something like dd.

>               When I created files in a floppy and deleted it, I am
> not able to recover it using autopsy. Autopsy could not recognise the
> file format. Can anyone help to solve this problem?

Could you give more info about the specific errors you encountered?
When you created files in the floppy, then deleted them, did you then dd
the floppy and load that image (result of the dd)?

What happens when you simply run "fsstat" on the image (assuming you
created one)? See if TSK recognizes the image.  Like this:  

# /path/to/sleuthkit-2.00/bin/fsstat /path/to/image

-- 
/***************************************
Special Agent Barry J. Grundy
NASA Office of Inspector General
Computer Crimes Division 
Goddard Space Flight Center
Code 190
Greenbelt Rd.
Greenbelt, MD 20771
(301)286-3358
**************************************/