[prev in list] [next in list] [prev in thread] [next in thread] 

List:       sleuthkit-users
Subject:    RE: [sleuthkit-users] Analyzing FreeBSD Partition
From:       "Brooks, Prentis" <prentis.brooks () twcable ! com>
Date:       2006-02-28 3:10:00
Message-ID: C86F66FC371EC34DB129EA9601142646028DD7AD () PRVPVSMAIL01 ! corp ! twcable ! com
[Download RAW message or body]

Thanks Brian and Barry,

after imaging /dev/hda, I was successful in gaining access to the filesystem.  I \
appreciate everyone who provided me these tips regarding how BSD managed the devices.


-----Original Message-----
From:	Brian Carrier [mailto:carrier@sleuthkit.org]
Sent:	Mon 2/27/2006 9:36 PM
To:	Brooks, Prentis
Cc:	bgrundy@imx.hq.nasa.gov; sleuthkit-users@lists.sourceforge.net
Subject:	Re: [sleuthkit-users] Analyzing FreeBSD Partition


On Feb 24, 2006, at 5:06 PM, Brooks, Prentis wrote:
> 
> So, I should have imaged /dev/had rather than /dev/hda1?

Yes, Barry is correct.  You should have imaged /dev/hda AND you need  
to keep in mind that the offsets in the FreeBSD disk label are  
relative to the start of the disk and not relative to the start of  
the FreeBSD partition.

brian





-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org


[prev in list] [next in list] [prev in thread] [next in thread]