Solved

linux paths helix boot CD

Posted on 2014-12-31
4
380 Views
Last Modified: 2015-02-05
I am using a free boot CD called Helix 3, which comes with a dos type utility to take a forensics image (replica copy) of an internal HDD (not encrypted). I have booted my system into helix, and selected the appropriate utility (linen)... applications > forensics and IR > linen

The linen app lists all physical and logic HDD in the machine.  

For example the internal HDD is listed as (/dev/sda/):

/dev/sda1
/dev/sda2
/dev/sda3

And the USB drive on which I want to write a copy of the internal HDD to (/dev/sdb1:

/dev/sdb1

I then chose the acquire option, which prompts for which drive I want to take a copy of. So I chose the "sda" option which will include all logical drives. It then (this is where the issue is) prompts for a path and file name on which to write the image to. When I put a path of /dev/sdb/sdb1 or /dev/sdb1/ it doesnt like it, and fails. Is there a standard naming convention for linux drives when specifying a path to write a file to? By default its just trying to write the drive to the sba1 drive (which maybe because it is the first partition on the list of drives on the machine)

Completely lost and there is very little in the way of user guides for this utility...
0
Comment
Question by:pma111
  • 3
4 Comments
 
LVL 3

Author Comment

by:pma111
ID: 40525230
It looks like issue could be that you first need to use terminal to cd to the external drive, and also mount as read/write, any idea how to dismount and then mount as read/write? or at least verify how it is currently mounted
0
 
LVL 3

Author Comment

by:pma111
ID: 40525306
if anyone fancies trying this the link to the boot CD is http://www.e-fense.com/products.php and its the link within:

•If you are looking for the free, original Helix (2009R1) you need Helix3

I am trying to write a copy out using an NTFS formatted HDD
0
 
LVL 62

Accepted Solution

by:
btan earned 500 total points
ID: 40525337
you may want to check out this forum on Helix and ext USB as ref
To mount the NTFS volume as RW in Helix....From root shell or sudo:
mount -t ntfs-3g /dev/hdx /media/hdx -o force

force is for forcing a mount when the volume was umounted improperly which that will be the case when using mkntfs to format it.
http://www.forensicfocus.com/Forums/viewtopic/t=2180/

and also this pdf on the step through on mounting (quite similar as above) using autopsy
https://dercyber.files.wordpress.com/2013/09/digital-forensic-analysis-using-helix-and-autopsy-forensic-imaging.pdf
0
 
LVL 3

Author Comment

by:pma111
ID: 40525365
That command appears to have done the trick!

Thanks!
0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you use Debian 6 Squeeze and you are tired of looking at the childish graphical GDM login screen that is used by default, here's an easy way to change it. If you've already tried to change it you've probably discovered that none of the old met…
FreeBSD on EC2 FreeBSD (https://www.freebsd.org) is a robust Unix-like operating system that has been around for many years. FreeBSD is available on Amazon EC2 through Amazon Machine Images (AMIs) provided by FreeBSD developer and security office…
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
In a previous video, we went over how to export a DynamoDB table into Amazon S3.  In this video, we show how to load the export from S3 into a DynamoDB table.

810 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question