Solved

linux paths helix boot CD

Posted on 2014-12-31
4
383 Views
Last Modified: 2015-02-05
I am using a free boot CD called Helix 3, which comes with a dos type utility to take a forensics image (replica copy) of an internal HDD (not encrypted). I have booted my system into helix, and selected the appropriate utility (linen)... applications > forensics and IR > linen

The linen app lists all physical and logic HDD in the machine.  

For example the internal HDD is listed as (/dev/sda/):

/dev/sda1
/dev/sda2
/dev/sda3

And the USB drive on which I want to write a copy of the internal HDD to (/dev/sdb1:

/dev/sdb1

I then chose the acquire option, which prompts for which drive I want to take a copy of. So I chose the "sda" option which will include all logical drives. It then (this is where the issue is) prompts for a path and file name on which to write the image to. When I put a path of /dev/sdb/sdb1 or /dev/sdb1/ it doesnt like it, and fails. Is there a standard naming convention for linux drives when specifying a path to write a file to? By default its just trying to write the drive to the sba1 drive (which maybe because it is the first partition on the list of drives on the machine)

Completely lost and there is very little in the way of user guides for this utility...
0
Comment
Question by:pma111
  • 3
4 Comments
 
LVL 3

Author Comment

by:pma111
ID: 40525230
It looks like issue could be that you first need to use terminal to cd to the external drive, and also mount as read/write, any idea how to dismount and then mount as read/write? or at least verify how it is currently mounted
0
 
LVL 3

Author Comment

by:pma111
ID: 40525306
if anyone fancies trying this the link to the boot CD is http://www.e-fense.com/products.php and its the link within:

•If you are looking for the free, original Helix (2009R1) you need Helix3

I am trying to write a copy out using an NTFS formatted HDD
0
 
LVL 63

Accepted Solution

by:
btan earned 500 total points
ID: 40525337
you may want to check out this forum on Helix and ext USB as ref
To mount the NTFS volume as RW in Helix....From root shell or sudo:
mount -t ntfs-3g /dev/hdx /media/hdx -o force

force is for forcing a mount when the volume was umounted improperly which that will be the case when using mkntfs to format it.
http://www.forensicfocus.com/Forums/viewtopic/t=2180/

and also this pdf on the step through on mounting (quite similar as above) using autopsy
https://dercyber.files.wordpress.com/2013/09/digital-forensic-analysis-using-helix-and-autopsy-forensic-imaging.pdf
0
 
LVL 3

Author Comment

by:pma111
ID: 40525365
That command appears to have done the trick!

Thanks!
0

Featured Post

Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Linux users are sometimes dumbfounded by the severe lack of documentation on a topic. Sometimes, the documentation is copious, but other times, you end up with some obscure "it varies depending on your distribution" over and over when searching for …
The purpose of this article is to demonstrate how we can use conditional statements using Python.
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
Connecting to an Amazon Linux EC2 Instance from Windows Using PuTTY.

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question