Re: unable to mount fs for forensics

From: Fred Mobach (fredat_private)
Date: Sun Dec 29 2002 - 13:54:01 PST

  • Next message: Bojan Zdrnja: "RE: Any Win32 version of "file"?"

    Susan Chan Lee wrote:
    > 
    > Having some problems mounting a filesystem which I imaged using dd for
    > forensic testing. The below is what I am doing with little success:
    > 
    > 1. dd the partition in question by - dd if=/dev/hda1
    > of=/forensics/images/hda1.dd
    > 2. create a mount point - mkdir /mnt/boot
    > 3. mounting the dd'ed fs with no success (tried a few variations):
    > 
    > # mount -o ro,loop,nodev,noexec forensics/images/hda1.dd mnt/boot
    > mount: wrong fs type, bad option, bad superblock on /dev/loop0,
    >        or too many mounted file systems
    > 
    > # mount -o ro,loop=/dev/loop1 forensics/images/hda1.dd /mnt/boot
    > mount: wrong fs type, bad option, bad superblock on /dev/loop1,
    >        or too many mounted file systems
    > 
    > As you can see I keep getting this wrong fs type error on both loop0 and
    > loop1.
    
    Some wild guesses :
    1. your kernel does not include support for the imaged filesystem,
    2. you might try to specify -t <filesysteme-type>,
    3. copy your file to a partition and run fsck / reiserfsck / ...,
    4. check the number of file systems already mounted.
    -- 
    Fred Mobach - fredat_private - postmasterat_private
    Systemhouse Mobach bv - The Netherlands - since 1976
    website : http://fred.mobach.nl
    Safe Harbour for encumbered Free and Open Source software and links:
    http://apache.dataloss.nl/~fred/
    
    -----------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Sun Dec 29 2002 - 17:42:30 PST