When mounted with FTK, it is 11.721.045.168 Sectors long instead. If I browse to that offset, I begin getting errors. According to R-Studio, it's reported as 1.46 TB, or 3.131.110.576 Sectors. OSFMount also successfully shows the first part of the disk. The UI (osfmount.exe) is able to correctly dismount the disks on this endpoint. D -m G: results in the process crashing the same behavior occurs with the -d switch. It successfully lets me browse the end of the image. Im running into a situation where the CLI is unable to dismount all mounted disks (-a -t file) on a specific endpoint. It can open it, and mount it (I was able to browse the partition after I wrote the first post). I'm not sure if OSForensics can open it, as I've never used that tool before. It basically reports back "Parameter is incorrect" for each sector being read. It does however, see a partition sized 5.45 TB - but when I browse this partition in R-Studios hex editor, and move towards the end, I get the error output shown below the listing. R-Studio indicates its size (top right) as 1.46 TB. In picture 2, it's been mounted and browsed in R-Studio. In step 4, I choose defaults, and then I mount it. In picture 1, we can see it detects partitions, one of which is 5.45 TB. When opened in OSFMount (which also takes a while - but FTK does this too, so that's probably just E01 for me).
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |