Use the iSCSI Enterprise Target software to serve your disk image as a
virtual disk.
There's a good HOWTO here:
http://fedoranews.org/mediawiki/index.php/Going_Enterprise_-_setup_your_FC4_iSCSI_target_in_5_minutes
and here:
http://mail.digicola.com/wiki/index.php?title=User:Martin:iSCSI
Once you configure your iSCSI target and initiator, you'll be able to
see your forensic disk image as a virtual SCSI device on your system.
I have done this many times.
FYI, An iSCSI initiator is essentially a virtual SCSI controller, and
an iSCSI target is a virtual SCSI device. You can run both pieces of
software on the same system.
On Sun, 2006-08-20 at 22:21 +0000, forensics-digest-
help@securityfocus.com wrote:
forensics Digest 20 Aug 2006 22:21:46 -0000 Issue 599
Topics (messages 3315 through 3315):
Mounting LVM image for analysis
3315 by: Nathaniel Hall
Administrivia:
To subscribe to the digest, e-mail:
<forensics-digest-subscribe@securityfocus.com>
To unsubscribe from the digest, e-mail:
<forensics-digest-unsubscribe@securityfocus.com>
To post to the list, e-mail:
<forensics@securityfocus.com>
----------------------------------------------------------------------
email message attachment (forensics_3315.ezm)
On Sun, 2006-08-20 at 22:21 +0000, forensics-digest-
help@securityfocus.com wrote:
Maybe I haven't looked deep enough, but I figure the experts would know
best. I believe a system of mine may have been compromised with a
rootkit. I have already taken an image of the system and split out the
partitions using the output from mmls and dcfldd. One of my partitions
is an LVM partition. It was on a SAN and we made it LVM so the
partition could be extended, but it never was.
I have the image on a Forensic system and I would like to be able to
browse the image as if it was another disk in the system. What would I
need to do?
