Re: 2 questions about tct and perl lfs

From: Brian Carrier (bcarrierat_private)
Date: Thu Aug 01 2002 - 06:05:37 PDT

  • Next message: Brian Carrier: "Re: Pagefile for reader/dumpers NT?"

    On Wed, Jul 31, 2002 at 10:50:45AM -0400, Hornat, Charles wrote:
    > Two questions for the group:
    > 
    > Trying to copy a 4 gig nt fat partition into a dd image.  Has anyone
    > had any experience slicing the image into pieces via counts and skips?
    > If so, has anyone tried to use TCT to review the images?  What would
    > the mount point be in the fsmorgue file for the last slices?
    
    You can't do it.  Autopsy is just a front-end to TASK (TCT) and it
    requires one big image.  The mount points are only cosmetic, they are
    only used when displaying the full path of a file.  So, you can make
    them whatever you want.
    
    brian
    
    
    -----------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Thu Aug 01 2002 - 06:54:06 PDT