Backtrack 4 R2 Digital Forensics Autopsy - Case Management

[anuragsingh84]

I have a portable hard disk that's essentially unmountable (the Windows PC it was connected to crashed and I guess that destroyed the FAT structures on it). Will Autopsy allow me to recover the data on it?

[polarbear35353]

Hello, I apologize if I sound ignorant but I just stared using Caine 2.0 today and I am sort of teaching myself but my questions were ; How do you get your image? Mount drive and create an ISO or will just a mount work? If a mount will work, do you have to be online to use Autopsy? Instead of linking the folders can't you just rename the New Volume folder to get around the space problem or do you have to link the folders? A friend turned me onto Ubuntu and I am trying to learn. Thank you!

[lecturesnippets]

@polarbear35353

To get an image of a partition or hard drive you can use the dcfldd command. You do not need to be online to use Autopsy. When you run the application it starts up a web server on the computer itself and you connect to it via your web browser. I several vids on my web site that are focused on using Backtrack, but you can substitute Ubuntu for many of the tasks as long as you have the software on it.

[polarbear35353]

@lecturesnippets Thank you very much!

[Screenfreezer]

Thanks so much!!