• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 459
  • Last Modified:

linux paths helix boot CD

I am using a free boot CD called Helix 3, which comes with a dos type utility to take a forensics image (replica copy) of an internal HDD (not encrypted). I have booted my system into helix, and selected the appropriate utility (linen)... applications > forensics and IR > linen

The linen app lists all physical and logic HDD in the machine.  

For example the internal HDD is listed as (/dev/sda/):


And the USB drive on which I want to write a copy of the internal HDD to (/dev/sdb1:


I then chose the acquire option, which prompts for which drive I want to take a copy of. So I chose the "sda" option which will include all logical drives. It then (this is where the issue is) prompts for a path and file name on which to write the image to. When I put a path of /dev/sdb/sdb1 or /dev/sdb1/ it doesnt like it, and fails. Is there a standard naming convention for linux drives when specifying a path to write a file to? By default its just trying to write the drive to the sba1 drive (which maybe because it is the first partition on the list of drives on the machine)

Completely lost and there is very little in the way of user guides for this utility...
  • 3
1 Solution
pma111Author Commented:
It looks like issue could be that you first need to use terminal to cd to the external drive, and also mount as read/write, any idea how to dismount and then mount as read/write? or at least verify how it is currently mounted
pma111Author Commented:
if anyone fancies trying this the link to the boot CD is http://www.e-fense.com/products.php and its the link within:

•If you are looking for the free, original Helix (2009R1) you need Helix3

I am trying to write a copy out using an NTFS formatted HDD
btanExec ConsultantCommented:
you may want to check out this forum on Helix and ext USB as ref
To mount the NTFS volume as RW in Helix....From root shell or sudo:
mount -t ntfs-3g /dev/hdx /media/hdx -o force

force is for forcing a mount when the volume was umounted improperly which that will be the case when using mkntfs to format it.

and also this pdf on the step through on mounting (quite similar as above) using autopsy
pma111Author Commented:
That command appears to have done the trick!

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now