Find the answer to your Linux question:
Results 1 to 4 of 4
Hey everybody. I am taking a class this semester on computer forensics. I am playing with a tool called SleuthKit ( http://www.sleuthkit.org/ ). The data I need to analyse is ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Linux Newbie
    Join Date
    Aug 2005
    Location
    Sterling, VA
    Posts
    100

    Disk Image of my Windows Partition


    Hey everybody.

    I am taking a class this semester on computer forensics. I am playing with a tool called SleuthKit (http://www.sleuthkit.org/). The data I need to analyse is my windows xp partition on the same computer.

    SleuthKit says to use the program "dd" to make an image of things. Is there anyway for me to make an image of my windows xp partion?

    Here is an example of what they suggest:

    Code:
    dd if=/dev/hdd of=/mnt/disk.dd bs=4k
    Basically, is there something under /dev that would point to my windows partition is mostly what I need to know.

    (p.s., fairly new to linux)

    Thanks in advance,

    EndianX
    - EndianX -

  2. #2
    Linux Enthusiast
    Join Date
    Jul 2005
    Location
    Maryland
    Posts
    522
    If all you want is to look at what is on your windows xp partition, then mount it, change directory to where you mounted it, and see what's there:
    Code:
    mkdir /mnt/windows
    mount -t ntfs /dev/hda1 /mnt/windows
    cd /mnt/windows
    ls
    replace hda1 with the number of partition on which xp is installed.

    P.S. Do not post your homeworks here.

  3. #3
    Linux Newbie
    Join Date
    Aug 2005
    Location
    Sterling, VA
    Posts
    100
    Quote Originally Posted by pavlo_7
    If all you want is to look at what is on your windows xp partition, then mount it, change directory to where you mounted it, and see what's there:
    Code:
    mkdir /mnt/windows
    mount -t ntfs /dev/hda1 /mnt/windows
    cd /mnt/windows
    ls
    replace hda1 with the number of partition on which xp is installed.

    P.S. Do not post your homeworks here.
    Thank you so much for the help! I'll give this a try.

    And its for a project. Going to see how NTFS' EFS, ADS File Hiding, and Cipher.exe's file wiping abilities stand up to forensic software.

    I suspect I'll fairly easily be able to view things hidden in alternate data streams. Files wiped and overwritten with cipher.exe may be a little more difficult. Still haven't figured out a way to break EFS.

    Its not a homework question like "how do you mount a windows partition in linux?"

    Anyway, thanks again!
    - EndianX -

  4. $spacer_open
    $spacer_close
  5. #4
    Linux Enthusiast
    Join Date
    Jul 2005
    Location
    Maryland
    Posts
    522
    You will need enough space on your Linux partition to copy an image of your windows there.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •