Re: unable to mount fs for forensics

From: Stephen Samuel (samuelat_private)
Date: Sun Dec 29 2002 - 18:37:02 PST

  • Next message: Geoffrey: "Re: Any Win32 version of "file"?"

    I don't see you forcing an fstype when you do the mount.
    
    Here's a quick way to do the probe (names taken from the mount(1)
    manpage)
    
    for i in auto ext2 ext3ext2 ext3 adfs affs autofs coda coherent cramfs devpts efs ext hfs hpfs iso9660 jfs minix msdos ncpfs nfs ntfs proc qnx4 reiserfs romfs smbfs sysv 
    tmpfs udf ufs umsdos vfat vxfs xenix xfs xiafs
    do
        echo attempting  type "'$i'"
        if mount -f $i -o ro,loop,nodev,noexec forensics/images/hda1.dd mnt/boot
        then
    	break
        done
    done
    
    (the for i line and the list of FS types is one line. the second line is 'do'
    
    Susan Chan Lee wrote:
    > Hi All
    > 
    > Having some problems mounting a filesystem which I imaged using dd for
    > forensic testing. The below is what I am doing with little success:
    .....
    > # mount -o ro,loop,nodev,noexec forensics/images/hda1.dd mnt/boot
    > mount: wrong fs type, bad option, bad superblock on /dev/loop0,
    >        or too many mounted file systems
    
    
    -- 
    Stephen Samuel +1(604)876-0426                samuelat_private
    		   http://www.bcgreen.com/~samuel/
    Powerful committed communication, reaching through fear, uncertainty and
    doubt to touch the jewel within each person and bring it to life.
    
    
    -----------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Sun Dec 29 2002 - 20:58:46 PST