sleuthkit-users

[sleuthkit-users] problem analysing apple hard disk

[Alessandro F. <at...@gm...>]

Hi
I'm analysing an image (EWF) extracted from an IMAC.
The disk (image) has 4 partition: 2 HFS+ and 2 NTFS (BOOTCAMP).
I'm using Autopsy 3.0.10 on Window 7 SP1.
 From the partition browser I can't access to one of the HFS+ partition.
The image file is ok, infact I can mount and browse all the partition in 
linux (via ewfmount) without any problem. The same happens if I access 
the image via ftk mounter on windows.
I think there is some sort of problem with Autopsy and I would like to 
help whith analysis and debug.
I can't send to many info on the contents because is part of an ongoing 
investigation, but I think I can share info on disk and partition structure.
Any help will be very appreciated.

Thanks in advance
Alessandro

Re: [sleuthkit-users] problem analysing apple hard disk

[Brian C. <ca...@sl...>]

So the image has four partitions, but one of them isn't showing any files?  


On Aug 14, 2014, at 5:42 AM, Alessandro Farina <at...@gm...> wrote:

> Hi
> I'm analysing an image (EWF) extracted from an IMAC.
> The disk (image) has 4 partition: 2 HFS+ and 2 NTFS (BOOTCAMP).
> I'm using Autopsy 3.0.10 on Window 7 SP1.
> From the partition browser I can't access to one of the HFS+ partition.
> The image file is ok, infact I can mount and browse all the partition in 
> linux (via ewfmount) without any problem. The same happens if I access 
> the image via ftk mounter on windows.
> I think there is some sort of problem with Autopsy and I would like to 
> help whith analysis and debug.
> I can't send to many info on the contents because is part of an ongoing 
> investigation, but I think I can share info on disk and partition structure.
> Any help will be very appreciated.
> 
> Thanks in advance
> Alessandro
> 
> ------------------------------------------------------------------------------
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] problem analysing apple hard disk

[Alessandro F. <at...@gm...>]

Yes.
If I select the partition in the partitions tree, nothing is show in the
detail window.


2014-08-21 4:09 GMT+02:00 Brian Carrier <ca...@sl...>:

> So the image has four partitions, but one of them isn't showing any files?
>
>
> On Aug 14, 2014, at 5:42 AM, Alessandro Farina <at...@gm...> wrote:
>
> > Hi
> > I'm analysing an image (EWF) extracted from an IMAC.
> > The disk (image) has 4 partition: 2 HFS+ and 2 NTFS (BOOTCAMP).
> > I'm using Autopsy 3.0.10 on Window 7 SP1.
> > From the partition browser I can't access to one of the HFS+ partition.
> > The image file is ok, infact I can mount and browse all the partition in
> > linux (via ewfmount) without any problem. The same happens if I access
> > the image via ftk mounter on windows.
> > I think there is some sort of problem with Autopsy and I would like to
> > help whith analysis and debug.
> > I can't send to many info on the contents because is part of an ongoing
> > investigation, but I think I can share info on disk and partition
> structure.
> > Any help will be very appreciated.
> >
> > Thanks in advance
> > Alessandro
> >
> >
> ------------------------------------------------------------------------------
> > _______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
>
>

Re: [sleuthkit-users] problem analysing apple hard disk

[Brian C. <ca...@sl...>]

Hi Alessandro,

Sorry for the delayed response.  I had a bit of travel going on. 

Can you add the image to a case again and notice if in the final panel of the "Add Data Source" wizard if there is a button that says that there were errors ingesting the image? If so, can you click on the button and send the messages?

We should review that panel because there have been several cases where people don't notice that some errors occurred...

thanks,
brian



On Sep 2, 2014, at 12:14 PM, Alessandro Farina <at...@gm...> wrote:

> Yes.
> If I select the partition in the partitions tree, nothing is show in the detail window.
> 
> 
> 2014-08-21 4:09 GMT+02:00 Brian Carrier <ca...@sl...>:
> So the image has four partitions, but one of them isn't showing any files?
> 
> 
> On Aug 14, 2014, at 5:42 AM, Alessandro Farina <at...@gm...> wrote:
> 
> > Hi
> > I'm analysing an image (EWF) extracted from an IMAC.
> > The disk (image) has 4 partition: 2 HFS+ and 2 NTFS (BOOTCAMP).
> > I'm using Autopsy 3.0.10 on Window 7 SP1.
> > From the partition browser I can't access to one of the HFS+ partition.
> > The image file is ok, infact I can mount and browse all the partition in
> > linux (via ewfmount) without any problem. The same happens if I access
> > the image via ftk mounter on windows.
> > I think there is some sort of problem with Autopsy and I would like to
> > help whith analysis and debug.
> > I can't send to many info on the contents because is part of an ongoing
> > investigation, but I think I can share info on disk and partition structure.
> > Any help will be very appreciated.
> >
> > Thanks in advance
> > Alessandro
> >
> > ------------------------------------------------------------------------------
> > _______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
> 
> 
> ------------------------------------------------------------------------------
> Slashdot TV.  
> Video for Nerds.  Stuff that matters.
> http://tv.slashdot.org/_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] problem analysing apple hard disk

[Alessandro F. <at...@gm...>]

Hi Brian
don't worry for the delay...I'm very grateful for your answers ;)
I've started another time Autopsy, new case, same image, file ingestion.
In the log I've find these "non critical" errors:

*******************
Errors occured while ingesting image
1. Database Error (TskDbSqlite::findParObjId: Error selecting file id by
meta_addr: unknown error (result code 101)
)
2.
3. Database Error (TskDbSqlite::findParObjId: Error selecting file id by
meta_addr: unknown error (result code 101)
)
4.
)
......

550485. Database Error (TskDbSqlite::findParObjId: Error selecting file id
by meta_addr: unknown error (result code 101)
)
550486. Cannot determine file system type (Sector offset: 235708600,
Partition Type: Recovery HD)
550487. Error reading image file (ewf_image_read - offset: 20480 - len:
65536 - Result too large) (TskAutoDb::addFsInfoUnalloc: error opening fs at
offset 20480)
550488. Error reading image file (ewf_image_read - offset: 209736704 - len:
65536 - Result too large) (TskAutoDb::addFsInfoUnalloc: error opening fs at
offset 209735680)
********************

The first errors are repeated a lot of times.
The the error about the image.
I assure you that the image is ok, I manage to mount and browse with ftk
(in Windows) and ewfmount (in linux).

If you think can be useful, I could send in private a cople of screenshot
whit Autopsy and FTK.

Thanks in advance for your help
Alessandro


2014-09-10 3:39 GMT+02:00 Brian Carrier <ca...@sl...>:

> Hi Alessandro,
>
> Sorry for the delayed response.  I had a bit of travel going on.
>
> Can you add the image to a case again and notice if in the final panel of
> the "Add Data Source" wizard if there is a button that says that there were
> errors ingesting the image? If so, can you click on the button and send the
> messages?
>
> We should review that panel because there have been several cases where
> people don't notice that some errors occurred...
>
> thanks,
> brian
>
>
>
> On Sep 2, 2014, at 12:14 PM, Alessandro Farina <at...@gm...> wrote:
>
> > Yes.
> > If I select the partition in the partitions tree, nothing is show in the
> detail window.
> >
> >
> > 2014-08-21 4:09 GMT+02:00 Brian Carrier <ca...@sl...>:
> > So the image has four partitions, but one of them isn't showing any
> files?
> >
> >
> > On Aug 14, 2014, at 5:42 AM, Alessandro Farina <at...@gm...>
> wrote:
> >
> > > Hi
> > > I'm analysing an image (EWF) extracted from an IMAC.
> > > The disk (image) has 4 partition: 2 HFS+ and 2 NTFS (BOOTCAMP).
> > > I'm using Autopsy 3.0.10 on Window 7 SP1.
> > > From the partition browser I can't access to one of the HFS+ partition.
> > > The image file is ok, infact I can mount and browse all the partition
> in
> > > linux (via ewfmount) without any problem. The same happens if I access
> > > the image via ftk mounter on windows.
> > > I think there is some sort of problem with Autopsy and I would like to
> > > help whith analysis and debug.
> > > I can't send to many info on the contents because is part of an ongoing
> > > investigation, but I think I can share info on disk and partition
> structure.
> > > Any help will be very appreciated.
> > >
> > > Thanks in advance
> > > Alessandro
> > >
> > >
> ------------------------------------------------------------------------------
> > > _______________________________________________
> > > sleuthkit-users mailing list
> > > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > > http://www.sleuthkit.org
> >
> >
> >
> ------------------------------------------------------------------------------
> > Slashdot TV.
> > Video for Nerds.  Stuff that matters.
> > http://tv.slashdot.org/_______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
>
>