Re: unable to mount fs for forensics

From: Eugen Cocalea (eugenat_private)
Date: Mon Dec 30 2002 - 02:16:01 PST

  • Next message: andrea.glorioso@binary-only.com: "Re: Any Win32 version of "file"?"

    Hi,
    
    I tried the same process as you did. I got first a failure and then,
    moving to a different machine and repeating the process, success.
    
    first machine (failure)
    - RedHat Linux 7.1
    - kernel 2.4.5 (pretty fancy optioned)
    - fileutils 4.0.36
    - mount-2.11b
    
    second machine (success)
    - RedHat Linux 7.2
    - kernel 2.4.8
    - fileutils 4.1
    - mount-2.11g
    
    trying
    
    mount -o loop image.dd /mountpoint -vv
    
    I get:
    
    mount: going to use the loop device /dev/loop3
    set_loop(/dev/loop3,ttt/image2.dd,0): success
    mount: setup loop device successfully
    EXT2-fs: loop(7,3): couldn't mount because of unsupported optional
    features (4).del_loop(/dev/loop3): success
    mount: wrong fs type, bad option, bad superblock on /dev/loop3,
           or too many mounted file systems
    
    so loop is no problem, i suppose that either defaults option of mount
    are a problem or dd.
    
    
    -- 
    Eugen Cocalea				||	eugenat_private
    ex - Network Administrator @ isratech.ro||	Phone: +40 232 219992
    						Cell: +40 723 605070
    
    On Dec 27, 2002, 1:59pm, Susan Chan Lee wrote:
    
    |SCL|Hi All
    |SCL|
    |SCL|Having some problems mounting a filesystem which I imaged using dd for
    |SCL|forensic testing. The below is what I am doing with little success:
    |SCL|
    |SCL|1. dd the partition in question by - dd if=/dev/hda1
    |SCL|of=/forensics/images/hda1.dd
    |SCL|2. create a mount point - mkdir /mnt/boot
    |SCL|3. mounting the dd'ed fs with no success (tried a few variations):
    |SCL|
    |SCL|# mount -o ro,loop,nodev,noexec forensics/images/hda1.dd mnt/boot
    |SCL|mount: wrong fs type, bad option, bad superblock on /dev/loop0,
    |SCL|       or too many mounted file systems
    |SCL|
    |SCL|# mount -o ro,loop=/dev/loop1 forensics/images/hda1.dd /mnt/boot
    |SCL|mount: wrong fs type, bad option, bad superblock on /dev/loop1,
    |SCL|       or too many mounted file systems
    |SCL|
    |SCL|As you can see I keep getting this wrong fs type error on both loop0 and
    |SCL|loop1.
    |SCL|
    |SCL|Any help appreciated.
    |SCL|
    |SCL|Thanks
    |SCL|Susan
    |SCL|
    |SCL|
    |SCL|
    |SCL|-----------------------------------------------------------------
    |SCL|This list is provided by the SecurityFocus ARIS analyzer service.
    |SCL|For more information on this free incident handling, management
    |SCL|and tracking system please see: http://aris.securityfocus.com
    |SCL|
    
    
    
    -----------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Mon Dec 30 2002 - 08:06:12 PST