±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 2 Overall: 34815
New Yesterday: 8 Visitors: 161

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Unrecognized file system[HPFS/NTFS]

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Unrecognized file system[HPFS/NTFS]

Post Posted: Sat May 06, 2017 11:18 pm

I have forensic images which i am trying to extract but when I am mounting in FTK imager they are showing Unrecognized file system[HPFS/NTFS] when i am trying to expand. I was told they are bitlocked but FTK imager doesn't show anywhere where i can use bit locker password. If anyone familiar to this and suggest how to open that would be helpful.

Thanks in advance.

Regards,
Ajeet  

ajeet129
Member
 
 
  

Re: Unrecognized file system[HPFS/NTFS]

Post Posted: Sun May 07, 2017 9:07 am

I guess the first place to start is checking for EFS in FTK Imager:

"To detect encrypted files
1. Do one of the following:
Click File > Detect Encryption.
Click the Detect Encryption button on the Toolbar.
The program scans the evidence and notifies you if encrypted files are located. As illustrated in the
figure above, EFS Encrypted files are indicated by a key icon, , in the Evidence Tree."  

mrpumba
Senior Member
 
 
  

Re: Unrecognized file system[HPFS/NTFS]

Post Posted: Mon Apr 16, 2018 5:15 pm

Ajeet129: Did you find a solution to your problem? What tool did you use to view it? I have a similar issue when viewing an image in FTK Imager version 4.1.1.1. Also, no EFS encryption was detected.  

Iron_Man
Newbie
 
 
  

Re: Unrecognized file system[HPFS/NTFS]

Post Posted: Mon May 21, 2018 1:43 pm

- ajeet129
I have forensic images which i am trying to extract but when I am mounting in FTK imager they are showing Unrecognized file system[HPFS/NTFS] when i am trying to expand. I was told they are bitlocked but FTK imager doesn't show anywhere where i can use bit locker password. If anyone familiar to this and suggest how to open that would be helpful.
Ajeet


Im going to make a couple assumption here and when you say "mount", you are talking about adding a disk image to FTKi. As far as im aware FTKi doesnt support decrypting disk images.

You can verify that it is indeed bitlocker encrypted by checking the header of the volume. Check out this link, www.forensicswiki.org/...Encryption

You should be able to use the mount feature in FTKi to mount the image and then use windows to unlock the volume and create a decrypted image.  

shakes6791
Newbie
 
 

Page 1 of 1