search

libyal / libewf

Libewf is a library to access the Expert Witness Compression Format (EWF)
GNU Lesser General Public License v3.0
265 stars 76 forks source link

ewfmount is mounting e01 in read-only mode #122

Closed normaliok closed 5 years ago

normaliok commented 5 years ago

I have the same issue as here https://github.com/libyal/libewf/issues/113 -X allow_root doesn't help

joachimmetz commented 5 years ago

That is as designed, ewfmount does not support write mode.

@normaliok #113 talks about several issues, you'll have to be more specific (provide more details about the issue you are experiencing) if you expect me to be of help

normaliok commented 5 years ago

That is as designed, ewfmount does not support write mode.

It's very pity (((

joachimmetz commented 5 years ago

It's very pity (((

No its not, it's deliberate. Forensics tools should limit write access as much as possible to prevent issues due to careless usage. If you cannot mount due to a dirty file system, there are work-arounds for this. However you'll need to be more specific in your issue report for me to be able to help you.

normaliok commented 5 years ago

You might be wondered but on the interview for a forensics investigator position one of the questions was "how to boot up an image acquired from investigated machine?" So, it's needful option to have a read-write access to the image.

joachimmetz commented 5 years ago

You might be wondered but on the interview for a forensics investigator position one of the questions was "how to boot up an image acquired from investigated machine?" So, it's needful option to have a read-write access to the image.

A lot of virtualization software supports differential images that track changes. So you can explain later on what has changed. Why does this require the ability to modify the original image?

normaliok commented 5 years ago

Ah, forget it )) You may close this issue

joachimmetz commented 5 years ago

@normaliok if you are unable to explain your issue or clarify point of view why adding this feature is necessary I'm unable to address it. I'll close the issue per your request.