![]() ![]() When mounted with FTK, it is 11.721.045.168 Sectors long instead. If I browse to that offset, I begin getting errors. According to R-Studio, it's reported as 1.46 TB, or 3.131.110.576 Sectors. OSFMount also successfully shows the first part of the disk. It successfully lets me browse the end of the image. It can open it, and mount it (I was able to browse the partition after I wrote the first post). I'm not sure if OSForensics can open it, as I've never used that tool before. ![]() It basically reports back "Parameter is incorrect" for each sector being read. It does however, see a partition sized 5.45 TB - but when I browse this partition in R-Studios hex editor, and move towards the end, I get the error output shown below the listing. R-Studio indicates its size (top right) as 1.46 TB. Updated columns for some categories - Updated Cookie columns - Fixed an issue where the drive letter format was not consistent resulting in different artifacts number on Live Acquisition and Drive scan Misc - Updated Volatility Workbench to v-beta.1 - Updated exiftool to. ![]() In picture 2, it's been mounted and browsed in R-Studio. Updated Downloads to support Firefox latest versions. In step 4, I choose defaults, and then I mount it. In picture 1, we can see it detects partitions, one of which is 5.45 TB. When opened in OSFMount (which also takes a while - but FTK does this too, so that's probably just E01 for me). ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |