Working with a Mac OS X HFS volume

[Mr. David J. Hughes]

I am trying to get a simple time line of files deleted on a Mac OS X  
10.4 volume formatted as a HFS+ partition.

It is my understanding that TSK does not understand HFS+ by default.  
Is there a simple set of step by step instructions on how to get it to  
understand HFS+.

I have tried this: sed -i 's/define TSK_USE_HFS 0/define TSK_USE_HFS  
1/'tsk3/fs/tsk_fs_i.h

and get the result: sed: 1: "tsk3/fs/tsk_fs_i.h": undefined label 'sk3/
fs/tsk_fs_i.h

Is there something I need to do before this command? Is the command  
correct? Do I need to do something after the command (recompile)?

I know that these tools require a good understanding of UNIX commands  
but I just want to use Autopsy to generate a timeline for deleted  
files. Does anyone know af a step by step set of instructions for this  
process?

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

[RB-14]

> I have tried this: sed -i 's/define TSK_USE_HFS 0/define TSK_USE_HFS
> 1/'tsk3/fs/tsk_fs_i.h

The problem is you didn't put a space between your last apostrophe (')
and the start of the file name (tsk3/...).  Sed then does not see the
end of the command and starts interpreting 'tsk' as more commands.

> Is there something I need to do before this command? Is the command
> correct? Do I need to do something after the command (recompile)?

Yes, once you do that successfully (it just twiddles the 'TSK_USE_HFS
0' to 'TSK_USE_HFS 1') you will most certainly need to re-compile.
Preferably do this between './configure' and 'make'.

> I know that these tools require a good understanding of UNIX commands
> but I just want to use Autopsy to generate a timeline for deleted
> files. Does anyone know af a step by step set of instructions for this
> process?

Unless you use the bleeding-edge SVN version
(http://svn.sleuthkit.org/repos/autopsy) of autopsy, you won't get HFS
support.  Brian added it on 10/1, and the latest beta of autopsy
(2.20b3) was released on 9/26.

Under the covers, autopsy just runs 'fls -m' (or 'ils -m') against the
image, then parses the output.  The documentation covers this, but
since you seem to refuse to read it:

# fls -m / -f hfs -i raw -a -r the_name_of_your_partition_image_here |
mactime -ymh > timeline.txt

Of course, that's somewhat incomplete too, because you likely haven't
split off the individual partitions, so you'll need to add a '-o
something' option to the fls command to tell it where the partition
you're processing lives.

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

[Mr. David J. Hughes]

Thank you for your response. I have read the documentation, but I am  
way outside of my area of knowledge. Many of the items covered in the  
documentation do not cover the basics enough for me to understand  
completely. I posted the question many days ago. I do not know why it  
just posted to the forum. I have been emailing with Brain back and  
forth the past few days trying to find out what is not working for me.  
I have made some headway.

First, thank you for your response about the HFS needing to be  
enabled. This information was critical in my progress. Not knowing I  
had the command wrong, I was able to use your suggestion to change the  
setting with a text editor and recompile.

Second, I have made progress with using the latest beta. I am able to  
recognize the image I have made with the dd command. My problem is  
that I have not been able to get the fls command to work.

Here is my terminal output showing the HFS support and the recognition  
of the drive image:

DJH-Nomadidata-2:sleuthkit-3.0.0b4 dasgeek$ ils -f list
Supported file system types:
        ntfs (NTFS)
        fat (FAT (Auto Detection))
        ext (ExtX (Auto Detection))
        iso9660 (ISO9660 CD)
        hfs (HFS+)
        ufs (UFS (Auto Detection))
        raw (Raw Data)
        swap (Swap Space)
        fat12 (FAT12)
        fat16 (FAT16)
        fat32 (FAT32)
        ext2 (Ext2)
        ext3 (Ext3)
        ufs1 (UFS1)
        ufs2 (UFS2)
DJH-Nomadidata-2:sleuthkit-3.0.0b4 dasgeek$ fls -f hfs -m / -r /
Volumes/alphafiles/AndrewHD.dd > data/body
-bash: data/body: No such file or directory
DJH-Nomadidata-2:sleuthkit-3.0.0b4 dasgeek$ fsstat /Volumes/alphafiles/
AndrewHD.dd
FILE SYSTEM INFORMATION
--------------------------------------------
File System Type: HFS+
File System Version: 4 (HFS+)
Last mounted version: 4846534a (Mac OS X, Journaled)
Volume Name: Andrew HD
Number of files: 392212
Number of folders: 91357
Created: Wed May 23 02:48:48 2007
Last Written at: Mon Sep 29 11:31:40 2008
Last Backed Up at: Thu Dec 31 18:00:00 1903
Last Checked at: Wed May 23 09:48:48 2007
Volume Unmounted Properly
Write count: 1188950

Journal Info Block: 893

METADATA INFORMATION
--------------------------------------------
First Block of Catalog File: 6782
Range: 2 - 536789
Bootable Folder ID: 3342 [/System/Library/CoreServices]
Startup App ID: 533710 [/System/Library/CoreServices/boot.efi]
Startup Open Folder ID: 0
Mac OS 8/9 Blessed System Folder ID: 0
Mac OS X Blessed System Folder ID: 3342 [/System/Library/CoreServices]
Volume Identifier: 6a8c6dee62d97cce

CONTENT INFORMATION
--------------------------------------------
Block Range: 0 - 29221227
Allocation Block Size: 4096
Free Blocks: 24555739
DJH-Nomadidata-2:sleuthkit-3.0.0b4 dasgeek$



On Brian's suggestion, I also ran the fls -v -f hfs -m / -r /Volumes/
alphafiles/AndrewHD.dd

It ran output to the screen but did not stop until the Terminal crashed.

That is where I am now.

Any suggestions would be appreciated.

I am going to try your command RB but I am not sure what you mean by  
splitting off individual partitions. I believe the drive image only  
has one partition unless something about the GUID setup for Intel macs  
has more than one partition. I am also going to try the latest  
Autopsy. Brian had not mentioned that the HFS code was there.


On Oct 4, 2008, at 2:54 PM, RB wrote:

>> I have tried this: sed -i 's/define TSK_USE_HFS 0/define TSK_USE_HFS
>> 1/'tsk3/fs/tsk_fs_i.h
>
> The problem is you didn't put a space between your last apostrophe (')
> and the start of the file name (tsk3/...).  Sed then does not see the
> end of the command and starts interpreting 'tsk' as more commands.
>
>> Is there something I need to do before this command? Is the command
>> correct? Do I need to do something after the command (recompile)?
>
> Yes, once you do that successfully (it just twiddles the 'TSK_USE_HFS
> 0' to 'TSK_USE_HFS 1') you will most certainly need to re-compile.
> Preferably do this between './configure' and 'make'.
>
>> I know that these tools require a good understanding of UNIX commands
>> but I just want to use Autopsy to generate a timeline for deleted
>> files. Does anyone know af a step by step set of instructions for  
>> this
>> process?
>
> Unless you use the bleeding-edge SVN version
> (http://svn.sleuthkit.org/repos/autopsy) of autopsy, you won't get HFS
> support.  Brian added it on 10/1, and the latest beta of autopsy
> (2.20b3) was released on 9/26.
>
> Under the covers, autopsy just runs 'fls -m' (or 'ils -m') against the
> image, then parses the output.  The documentation covers this, but
> since you seem to refuse to read it:
>
> # fls -m / -f hfs -i raw -a -r the_name_of_your_partition_image_here |
> mactime -ymh > timeline.txt
>
> Of course, that's somewhat incomplete too, because you likely haven't
> split off the individual partitions, so you'll need to add a '-o
> something' option to the fls command to tell it where the partition
> you're processing lives.
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's  
> challenge
> Build the coolest Linux based applications with Moblin SDK & win  
> great prizes
> Grand prize is a trip for two to an Open Source event anywhere in  
> the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

[RB-14]

On Sat, Oct 4, 2008 at 15:53, Mr. David J. Hughes <dasgeek@...> wrote:
> Thank you for your response. I have read the documentation, but I am way
> outside of my area of knowledge.

As gently as kindly as possible, then: if this is for [even potential]
legal action, you need help and not from just random volunteers on a
mailing list.  Computer forensics is a deep-knowledge field that
cannot be just picked up in a week.  Forensics using Sleuthkit is even
more so because it requires a more-than-passing familiarity with the
UNIX CLI environment.  I am not a lawyer, and this neither constitutes
legal advice nor my estimation of Sleuthkit as a forensic tool, but
many of us retain attorneys (or work directly for them) for very good
reasons.

That said, on with the work at hand:

> Second, I have made progress with using the latest beta. I am able to
> recognize the image I have made with the dd command. My problem is that I
> have not been able to get the fls command to work.
>
<snip>
> DJH-Nomadidata-2:sleuthkit-3.0.0b4 dasgeek$ fls -f hfs -m / -r
> /Volumes/alphafiles/AndrewHD.dd > data/body
> -bash: data/body: No such file or directory

This is most likely because the directory 'data' did not exist.

> DJH-Nomadidata-2:sleuthkit-3.0.0b4 dasgeek$ fsstat
> /Volumes/alphafiles/AndrewHD.dd
> FILE SYSTEM INFORMATION

This, too, is unfortunate - you don't seem to have gotten the
_complete_ image, including the GPT.  Good for now so we don't have to
walk through calculating offsets ("splitting partitions"), but poor
for evidentiary purposes.

> On Brian's suggestion, I also ran the fls -v -f hfs -m / -r
> /Volumes/alphafiles/AndrewHD.dd
>
> It ran output to the screen but did not stop until the Terminal crashed.

This is because the command you ran produces a line of output fully
describing the location and status for every single file and directory
on the filesystem - rather voluminous at best, and monstrous on some
systems.  The reason Terminal crashed was likely because you have it
set to buffer 'infinite' lines (Terminal -> Window Settings ->
Buffer), and the amount of data it buffered exceeded the amount of
memory it could address, resulting in a crash.

You need to redirect the output of the command to a file; the above
command where you got the result "data/body: No such file or
directory" had the idea right.  Do 'fls -v -f hfs -m / -r
/Volumes/alphafiles/AndrewHD.dd > my_index.txt' in a directory where
you have at least several hundred megabytes' worth of free space.  The
'>' character redirects output in the shell, whereas the '|' in my
earlier command "pipes" data between commands, eliminating the interim
file.  Both are reasonable approaches, but Brian's suggestion of
putting it into a file is wiser, as it speeds later analysis by only
generating the index once.

> one partition. I am also going to try the latest Autopsy. Brian had not
> mentioned that the HFS code was there.

The latest autopsy won't cut it - if you're downloading any version
generated before 2008/10/01, it won't have what you're looking for.
As of 00:10 UTC, I don't see the version that checks for HFS support
available for download, even as beta.

You're on the right path and I [we?] am more than willing to help you
as I can, but please step back and consider where you're taking this -
if for personal learning or simply trying to recover lost work, then
forge on but please learn some basic shell usage first.  However, the
indications I'm getting from you (termination, deleted contacts, in a
hurry) seem to indicate a potential intent for legal action, in which
case my first paragraph stands - find a local professional and get
this job done, then come back and learn.


RB

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

[Mr. David J. Hughes]

Your advise is well placed and has been heard, RB. Thank you for your  
help.

Brian had me run the output to the Terminal as a trouble shooting  
step. The first time I ran it to the Terminal (using 3.0.0b3) it did  
not crash. I saved the large output, zipped it and sent it to Brian.  
He suggested I try the latest build B4 and that is when the output  
just kept outputting until the Term crashed. I have the buffer set to  
unlimited but it still choked. I will try your advise to output to a  
text file.

Is there a better way to capture the entire image. I used the Terminal  
dd command to copy the drive image. Does that not copy the whole drive  
bit for bit?


On Oct 4, 2008, at 7:44 PM, RB wrote:

> On Sat, Oct 4, 2008 at 15:53, Mr. David J. Hughes <dasgeek@...>  
> wrote:
>> Thank you for your response. I have read the documentation, but I  
>> am way
>> outside of my area of knowledge.
>
> As gently as kindly as possible, then: if this is for [even potential]
> legal action, you need help and not from just random volunteers on a
> mailing list.  Computer forensics is a deep-knowledge field that
> cannot be just picked up in a week.  Forensics using Sleuthkit is even
> more so because it requires a more-than-passing familiarity with the
> UNIX CLI environment.  I am not a lawyer, and this neither constitutes
> legal advice nor my estimation of Sleuthkit as a forensic tool, but
> many of us retain attorneys (or work directly for them) for very good
> reasons.
>
> That said, on with the work at hand:
>
>> Second, I have made progress with using the latest beta. I am able to
>> recognize the image I have made with the dd command. My problem is  
>> that I
>> have not been able to get the fls command to work.
>>
> <snip>
>> DJH-Nomadidata-2:sleuthkit-3.0.0b4 dasgeek$ fls -f hfs -m / -r
>> /Volumes/alphafiles/AndrewHD.dd > data/body
>> -bash: data/body: No such file or directory
>
> This is most likely because the directory 'data' did not exist.
>
>> DJH-Nomadidata-2:sleuthkit-3.0.0b4 dasgeek$ fsstat
>> /Volumes/alphafiles/AndrewHD.dd
>> FILE SYSTEM INFORMATION
>
> This, too, is unfortunate - you don't seem to have gotten the
> _complete_ image, including the GPT.  Good for now so we don't have to
> walk through calculating offsets ("splitting partitions"), but poor
> for evidentiary purposes.
>
>> On Brian's suggestion, I also ran the fls -v -f hfs -m / -r
>> /Volumes/alphafiles/AndrewHD.dd
>>
>> It ran output to the screen but did not stop until the Terminal  
>> crashed.
>
> This is because the command you ran produces a line of output fully
> describing the location and status for every single file and directory
> on the filesystem - rather voluminous at best, and monstrous on some
> systems.  The reason Terminal crashed was likely because you have it
> set to buffer 'infinite' lines (Terminal -> Window Settings ->
> Buffer), and the amount of data it buffered exceeded the amount of
> memory it could address, resulting in a crash.
>
> You need to redirect the output of the command to a file; the above
> command where you got the result "data/body: No such file or
> directory" had the idea right.  Do 'fls -v -f hfs -m / -r
> /Volumes/alphafiles/AndrewHD.dd > my_index.txt' in a directory where
> you have at least several hundred megabytes' worth of free space.  The
> '>' character redirects output in the shell, whereas the '|' in my
> earlier command "pipes" data between commands, eliminating the interim
> file.  Both are reasonable approaches, but Brian's suggestion of
> putting it into a file is wiser, as it speeds later analysis by only
> generating the index once.
>
>> one partition. I am also going to try the latest Autopsy. Brian had  
>> not
>> mentioned that the HFS code was there.
>
> The latest autopsy won't cut it - if you're downloading any version
> generated before 2008/10/01, it won't have what you're looking for.
> As of 00:10 UTC, I don't see the version that checks for HFS support
> available for download, even as beta.
>
> You're on the right path and I [we?] am more than willing to help you
> as I can, but please step back and consider where you're taking this -
> if for personal learning or simply trying to recover lost work, then
> forge on but please learn some basic shell usage first.  However, the
> indications I'm getting from you (termination, deleted contacts, in a
> hurry) seem to indicate a potential intent for legal action, in which
> case my first paragraph stands - find a local professional and get
> this job done, then come back and learn.
>
>
> RB
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's  
> challenge
> Build the coolest Linux based applications with Moblin SDK & win  
> great prizes
> Grand prize is a trip for two to an Open Source event anywhere in  
> the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

[RB-14]

> Is there a better way to capture the entire image. I used the Terminal dd
> command to copy the drive image. Does that not copy the whole drive bit for
> bit?

It does, but the precise command you called is what is in question -
if you did something to the effect of:

dd if=/dev/disk0 of=/Volumes/store/my_image.dd

You should be okay, but I'm still confused as to why 'fsstat' treats
your image as a filesystem image and not a raw one.  If you did:

dd if=/dev/disk0s2 of=/Volumes/store/my_image.dd

You're missing both the partition table and the 200MB (on my MacBook)
EFI partition.  Note that on the second one, I added 's2' to the disk
designation, specifying the second effective partition (even though
OSX only sees one) and wholly skipping the GPT and EFI information.


RB

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

[charles-11]

My two cents.
I've noticed you didn't specify a block size. Try adding bs=512 to the end of your dd command and try again.
------Original Message------
From: RB
Sender:
To: sleuthkit-users@...
Sent: Oct 4, 2008 8:13 PM
Subject: Re: [sleuthkit-users] Working with a Mac OS X HFS volume

> Is there a better way to capture the entire image. I used the Terminal dd
> command to copy the drive image. Does that not copy the whole drive bit for
> bit?

It does, but the precise command you called is what is in question -
if you did something to the effect of:

dd if=/dev/disk0 of=/Volumes/store/my_image.dd

You should be okay, but I'm still confused as to why 'fsstat' treats
your image as a filesystem image and not a raw one.  If you did:

dd if=/dev/disk0s2 of=/Volumes/store/my_image.dd

You're missing both the partition table and the 200MB (on my MacBook)
EFI partition.  Note that on the second one, I added 's2' to the disk
designation, specifying the second effective partition (even though
OSX only sees one) and wholly skipping the GPT and EFI information.


RB

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org


Thanks,
Charles Tendell
Network Security & E-discovery  
http://charlestendell.com
303.872.0115
Sent via BlackBerry
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

[RB-14]

On Sat, Oct 4, 2008 at 20:17,  <charles@...> wrote:
> My two cents.
> I've noticed you didn't specify a block size. Try adding bs=512 to the end of your dd command and try again.

Not entirely necessary; dd defaults to a blocksize of 512 bytes.  In
his particular situation, the only advantage specifying a blocksize
might have is marginal speed-up by taking greater advantage of
in-memory buffering.

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

[Simson Garfinkel-3]

I always add

        conv=noerror,sync

Without this, an error will cause the imaging to fail.

I also usually add

        bs=65536

Which increases the blocksize to something reasonable.

Also, beware of the diskarbitration daemon on a Mac...

On Oct 4, 2008, at 7:13 PM, RB wrote:

>> Is there a better way to capture the entire image. I used the  
>> Terminal dd
>> command to copy the drive image. Does that not copy the whole drive  
>> bit for
>> bit?
>
> It does, but the precise command you called is what is in question -
> if you did something to the effect of:
>
> dd if=/dev/disk0 of=/Volumes/store/my_image.dd
>
> You should be okay, but I'm still confused as to why 'fsstat' treats
> your image as a filesystem image and not a raw one.  If you did:
>
> dd if=/dev/disk0s2 of=/Volumes/store/my_image.dd
>
> You're missing both the partition table and the 200MB (on my MacBook)
> EFI partition.  Note that on the second one, I added 's2' to the disk
> designation, specifying the second effective partition (even though
> OSX only sees one) and wholly skipping the GPT and EFI information.
>
>
> RB
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's  
> challenge
> Build the coolest Linux based applications with Moblin SDK & win  
> great prizes
> Grand prize is a trip for two to an Open Source event anywhere in  
> the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

[Brian Carrier-2]

On Oct 4, 2008, at 8:44 PM, RB wrote:
>> DJH-Nomadidata-2:sleuthkit-3.0.0b4 dasgeek$ fls -f hfs -m / -r
>> /Volumes/alphafiles/AndrewHD.dd > data/body
>> -bash: data/body: No such file or directory
>
> This is most likely because the directory 'data' did not exist.

Ahh, you are right.  Good call.  I was trying to figure out why that  
message would appear.

>
>> On Brian's suggestion, I also ran the fls -v -f hfs -m / -r
>> /Volumes/alphafiles/AndrewHD.dd
>>
>> It ran output to the screen but did not stop until the Terminal  
>> crashed.
>
> This is because the command you ran produces a line of output fully
> describing the location and status for every single file and directory
> on the filesystem - rather voluminous at best, and monstrous on some
> systems.  The reason Terminal crashed was likely because you have it
> set to buffer 'infinite' lines (Terminal -> Window Settings ->
> Buffer), and the amount of data it buffered exceeded the amount of
> memory it could address, resulting in a crash.
>
> You need to redirect the output of the command to a file; the above
> command where you got the result "data/body: No such file or
> directory" had the idea right.  Do 'fls -v -f hfs -m / -r
> /Volumes/alphafiles/AndrewHD.dd > my_index.txt' in a directory where
> you have at least several hundred megabytes' worth of free space.  The
> '>' character redirects output in the shell, whereas the '|' in my
> earlier command "pipes" data between commands, eliminating the interim
> file.  Both are reasonable approaches, but Brian's suggestion of
> putting it into a file is wiser, as it speeds later analysis by only
> generating the index once.

Actually, the goal of adding '-v' was to determine why no data was  
being generated, but the non-existent data directory could have been  
the cause.  First, try again w/out the -v and to a file in the local  
directory (or be sure to make the data directory):

# fls -f hfs -m / -r /Volumes/alphafiles/AndrewHD.dd > body.txt

If the output does not have any data, then try this:

# fls -f hfs -m / -r -v /Volumes/alphafiles/AndrewHD.dd >body.txt  2>  
verbose.txt

and then send me verbose.txt.

thanks,
brian


-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org