autopsy not able to open dd image

stevegut78 · 2008-08-27T19:43:57Z

Hey guys it's been a while. I've stumbled across a weird problem. While I've done many dd images, I have never had an issue opening them up with autopsy. I use the Helix CD in windows to make an image of my investigation drives using the GUI interface for dd. Then, boot the Helix cd to linux and run autopsy.The drive I am currently working on is a 2.5" SATA drive from a Thinkpad T61. It appears to have a hidden utility partition (part of Lenovo utils). The dd image completes successfully, but I get an interesting error when attempting to open the image in Autopsy. I have tried both logical and the entire disk… The error that I get in Autopsy isWarning file system of the volume image file could not be determined. If this is a disk image file, return to the previous page and change the type. I'm tending to think it has something to do with the hidden utility partition, but I don't know how to work around this. I can easily browse the NTFS partition while in Linux so I know everything is intact.Any ideas?

Page 2 / 2 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by Anonymous 18 years ago

11 Posts

6 Users

0 Reactions

9,080 Views

RSS

Anonymous 6593

(@Anonymous 6593)

Joined: 18 years ago

Posts: 1158

28/08/2008 5:26 pm

I use the Helix CD in windows to make an image of my investigation drives using the GUI interface for dd. Then, boot the Helix cd to linux and run autopsy.

What did you image – the physical drive or the file system? What does the audit log file say?

ReplyQuote

Page 2 / 2 Prev