Re: NTFS forensic analysis on Unix platform

From: Jonas Luster (jluster@d-fensive.com)
Date: Sun Jul 29 2001 - 07:15:10 PDT

Next message: ryan.b.lynchat_private: "Revisited: HALs under NT4.0"

Previous message: Kruse, Warren G, II (Warren): "RE: NTFS forensic analysis on Unix platform"
In reply to: Frank Knobbe: "RE: NTFS forensic analysis on Unix platform"
Next in thread: Kruse, Warren G, II (Warren): "RE: NTFS forensic analysis on Unix platform"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

* Frank Knobbe sez:

: That raises one question though: How do you grep or sift through two
: striped disks without mounting them? Does EnCase or similar tools
: provide support for striped NTFS disks?

cramloop.o - I don't know where I picked it up, originally, but the
ability to mount more than one image as a md-loop (read-only of course)
makes this module very useful.

application/pgp-signature attachment: stored

Next message: ryan.b.lynchat_private: "Revisited: HALs under NT4.0"
Previous message: Kruse, Warren G, II (Warren): "RE: NTFS forensic analysis on Unix platform"
In reply to: Frank Knobbe: "RE: NTFS forensic analysis on Unix platform"
Next in thread: Kruse, Warren G, II (Warren): "RE: NTFS forensic analysis on Unix platform"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Sun Jul 29 2001 - 16:04:20 PDT