Saludos:
I'm adding a forensic image file with this layout.
---------------
vol1 (Unallocated: 0-62) 1 0 63 Unallocated Unallocated
vol2 (Linux Swap / Solaris x86 (0x82): 63-996029) 2 63 995967
Linux Swap / Solaris x86 (0x82) Allocated
vol3 (Linux (0x83): 996030-20964824) 3 996030 19968795 Linux
(0x83) Allocated
vol4 (Unallocated: 20964825-20971519) 4 20964825 6695
Unallocated Unallocated
---------------
But Autopsy 3 expose this messages. Most of the folders have the
"deleted" icon, and size 0.
------------------
ADVERTENCIA: Data errors occurred while running add image.
Exception: org.sleuthkit.datamodel.TskDataException: Errors occured while
ingesting image
1. Cannot determine file system type (Sector offset: 63, Partition Type:
Linux Swap / Solaris x86 (0x82))
nov 11, 2014 3:53:39 PM org.sleuthkit.autopsy.casemodule.AddImageTask
postProcess
INFORMACIÓN: There were errors that occured in add image process
nov 11, 2014 3:53:39 PM org.sleuthkit.autopsy.casemodule.AddImageTask
commitImage
INFORMACIÓN: Image committed, imageId: 1
nov 11, 2014 3:53:39 PM org.sleuthkit.autopsy.casemodule.AddImageTask
commitImage
INFORMACIÓN: Physical memory usage (max, total, free): 518979584, 37380096,
2262464
JVM heap usage: init = 25165824(24576K) used = 35117632(34294K) committed =
37380096(36504K) max = 518979584(506816K), JVM non-heap usage: init =
163840(160K) used = 27939056(27284K) committed = 28966912(28288K) max =
-1(-1K)
Process Virtual Memory: 881.123.328
------------------
Thanks by your answers.
Atte.
--
Alonso Eduardo Caballero Quezada - www.ReYDeS.com/d/?q=blog -
Re...@gm...
Brainbench Certified Network Security, Computer Forensics (US) & Linux
Administration
http://pe.linkedin.com/in/alonsocaballeroquezada -
https://twitter.com/Alonso_ReYDeS
<Re...@gm...>
|
