The Sleuth Kit/Auto...
 
Notifications
Clear all

The Sleuth Kit/Autopsy problem

15 Posts
6 Users
0 Reactions
3,635 Views
(@Anonymous)
Guest
Joined: 1 second ago
Posts: 0
Topic starter  

I can use ubuntu a bit but I'm not totally clued up regarding all the commands.

I got it working using

mkdir /mnt/usbdrive

mount -t vfat /dev/sdb1 -r /msn/usbdrive

My ipods connected which must be setting it to "b".

Thanks again.

Edit Opps, it was

mount -r -t vfat /dev/sdb1 /mnt/usbdrive


   
ReplyQuote
Beetle
(@beetle)
Reputable Member
Joined: 17 years ago
Posts: 318
 

Hi there,

Glad you have it working but I noticed that the -r option is not in the right place as in the man page. I am not sure if you actually have it read only as I always use the command as I had in my previous post but you can check by using the mount command with no options. You should see something like this

bt ~ # mount
aufs on / type aufs (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
usbfs on /proc/bus/usb type usbfs (rw)
.host/ on /mnt/hgfs type vmhgfs (rw,ttl=5)
none on /proc/fs/vmblock/mountPoint type vmblock (rw)

with your read only drive partition showing ro instead of rw.

RB


   
ReplyQuote
(@Anonymous)
Guest
Joined: 1 second ago
Posts: 0
Topic starter  

I'm back. Autopsy won't accept an image of a HD. I'm just learning how to use the software so it's not for an investigation or anything.

To the point, upon adding the image location

/mnt/usbdrive/Office/image.*
or
/mnt/usbdrive/Office/image.dd.*

With symlink, ntfs (the image's file system), C, calculate selected, I get an error saying,

"Invalid image path (only letters, numbers, -, .,_ and start with /) etc

The DD image has been split to fat32 so it can be stored on my usb hd. The Autopsy help documents say to use * where images are split.

Anyone know what's going on?

Thanks!


   
ReplyQuote
Beetle
(@beetle)
Reputable Member
Joined: 17 years ago
Posts: 318
 

hmmm…

Can you post the 'ls -la' output for your storage drive?

I would like to see the names of the image and permissions

RB


   
ReplyQuote
(@Anonymous)
Guest
Joined: 1 second ago
Posts: 0
Topic starter  

Too late. I just formatted it into ntfs and re-imaged the pc with dd.

Got it working though.

Thanks again.


   
ReplyQuote
Page 2 / 2
Share: