Re: Having trouble breaking partitions out of a raw image

Christopher,


> 2) Next, I wanted to break out the raw image into it's partitions, so I ran
> mmls:
>
> root@LinuxForensics usbdisk]# mmls -t dos image.dd

You might try 'sfdisk -uS -l image.dd' in the future.  Unless, of
course, it's a MAC image, then 'mmls' is your choice.


> [root@LinuxForensics usbdisk]# file image3.dd
> image3.dd: data

As a sanity check, authenticate the file system (/dev/target#) against
this newly ripped image file of the file system from the 80GB physical
image.  (Just to make sure the MD5/SHA1 equal)

Aside from that, 'file' isn't always best to determine type of file when
it comes to FS types.  You might get better mileage passing the 's' flag
to your command;

file -s image.dd

?


> One last thing....I ran fdisk -lu on the image.  It does not show as
> bootable (which is odd since I was told it was the only disk in the system).

Some operating systems don't require the bootable flag to be set in the
partition record field.  


cheers!

farmerdude