±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35628
New Yesterday: 3 Visitors: 116

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

digital camera: how to image PTP?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

calimelo
Senior Member
 

digital camera: how to image PTP?

Post Posted: Feb 09, 11 17:16

Hi all,

I have a nikon s52 camera with an internal memory. There are files i need to recover from the memory but i can't create a forensic image because the only way i can mount the camera's memory is using fuse. I mounted it with gphotofs and now i can access it in its mounted directory. However i can not create a forensic image using dd because it tells me that the device is busy.

The memory that was mounted is [email protected] > /home/user/tmp

i am using dd if=/dev/fuse0 of=/home/user/case/image.dd

what am i missing?

thanks

cal

add- how do you guys examine cameras using Picture Transfer Protocol?
in mac os x it automatically pops-up iphoto. No mounting.
_________________
"Simplicity is the ultimate sophistication." 
 
  

Joël
Newbie
 

Re: digital camera: how to image PTP?

Post Posted: Feb 09, 11 19:03

Hi,

The mounting process or dameon on Mac OS X is "diskarbitratord"
you have to launch monitor activity and kill this process
and now the automounting is off.
Restart your machine to reactivate diskarbitrator

Joël Gomez
Forensic Expert
French Gendarmerie  
 
  

calimelo
Senior Member
 

Re: digital camera: how to image PTP?

Post Posted: Feb 09, 11 19:21

Mr Gomez thank you for replying. My problem is not about automounting. I can access the files. I can even mount it as a fuse drive. The thing is although the system mounts it, it's not really a filesystem. So i can't use dd or something else to create a copy. Picture transfer protocol sucks.
_________________
"Simplicity is the ultimate sophistication." 
 
  

Joël
Newbie
 

Re: digital camera: how to image PTP?

Post Posted: Feb 09, 11 19:57

Thank's

but i don't understand something
If you want to image forenzically your memory you don't have to mount it.

If you want the physical device:
no need to mount something and your command is OK
the device is detected

If you want the logical device(partition), /dev/fuse0 is the physical device so it's not possible (busy because the partition is mounted)

if you run linux try "sudo fdisk -l"
the result is device and partitions connected in your system

Joël  
 
  

azrael
Senior Member
 

Re: digital camera: how to image PTP?

Post Posted: Feb 09, 11 20:02

Are you running as root ? If not, try that (SuDo) - that can be a cause of the "resource busy" error.
_________________
--
Azrael
-- 
 
  

calimelo
Senior Member
 

Re: digital camera: how to image PTP?

Post Posted: Feb 09, 11 20:06

@joël: i can't get a /dev/fuse0 device if i don't mount the camera using gphotofs.
@azrael: i have root permisions.
_________________
"Simplicity is the ultimate sophistication." 
 
  

Joël
Newbie
 

Re: digital camera: how to image PTP?

Post Posted: Feb 09, 11 20:10

OK
so if i understand, if you just plug your camera on your computer you can't see the device

Joël  
 

Page 1 of 2
Page 1, 2  Next