Using CAINE and MMLS to mount an image of an NTFS drive

View previous topic View next topic Go down

Using CAINE and MMLS to mount an image of an NTFS drive

Post  joetekno on Mon Mar 02, 2009 8:04 pm

At some point you my want to view an operating system image file as it was as a file system. This enables quick restoration of files, string searches, e-discovery, etc. The following directions will walk you through mounting an image of an operating system so that you can quickly view it as a file system.

1. Select "Start"... Caine... Caine Interface
2. Click the "Create Report" button
3. Select the "Grissom Analyzer" tab
4. Type the location of your image file (example: /evidence/sda-img.dd)
5. Click the “mmls” button
6. Document the UNITS (example: Units are in 512-byte sectors)
7. Document the start of the partition you wish to mount (example: 0000000063)
8. Multiply the start of the partition with the Units (example 63 X 512 = 32256)
9. Make a directory in /media to mount the image to. The offset below comes from the number you came up with in step 8.
a. Open an Command Line Window
b. Type: sudo su
c. And then enter your password
d. Type: mkdir /media/evidence
e. Type: mount -t ntfs -o loop,ro,offset=32256 /evidence/sda-img.dd /media/evidence
10. Now you can us the “cd” command to view the image file’s directory structure
a. Type: cd /media/evidence
b. Type: ls
avatar
joetekno

Number of posts : 50
Località : Wisconsin, United States
Registration date : 2009-02-19

View user profile http://network.nwtc.edu

Back to top Go down

Re: Using CAINE and MMLS to mount an image of an NTFS drive

Post  nannib on Tue Mar 03, 2009 9:25 am

Thank you so much!
These various methods for reaching the wished target are very useful Wink
Thank you again for your efforts...

Nanni Bassetti
Caine Team
avatar
nannib
Admin

Number of posts : 271
Age : 47
Registration date : 2008-10-28

View user profile http://www.nannibassetti.com/

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum