are you mounting your drives before imaging them? that shouldn't be
necessary. your imaging software (dd?) doesn't care about file formats, only
devices -- so I think you should image it first before doing anything else
without mounting the subject drive at all.
are you imaging from disk to disk, or disk to file? assuming you've
completed a disk to disk image, try this on the completed copy:
fdisk -lu /dev/hdb
it will list the number and type of partitions you're dealing with
I don't have my linux box up, or I'd be able to tell if you can fdisk a file
image as well. I think you can, but I don't remember.
Jeff
-----Original Message-----
From: Nick Puetz [mailto:nickpuetz@yahoo.com]
Sent: Thursday, September 30, 2004 7:43 AM
To: forensics@securityfocus.com
Subject: Hard disk file system identification
I have received an internal hard drive that I need to image and perform some
analysis on; however, I don't know the file system type on the disk, there
for, I can not correctly mount it to the RedHat 9 machine I used to do my
image creation and analysis. Is there any way that I can identify what file
system type is on a hard disk without jeopardizing the integrity of the hard
disk? Thanks for the help.
Nick
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
