Closed omar11alhajj closed 1 year ago
Or do I actually have to create an image from an operating system? Like the C drive should be imaged? But what if want to analyze a usb?
Hi @omar11alhajj , have you checked the partition structure of the ewf1 "image" to see if it needs to be mounted at a specific offset? You can try mmls ewf1
from the directory where your ewf1 image is. If it does need an offset, you can add the offset to the mountwin command by adding -o offset=
before the "ewf1" part of your command, like so:
mountwin -o offset=$((2048*512)) ewf1 /mnt/windows_mount
- assuming your offset is 2048 and the sector size is 512.
thanks alot @digitalsleuth
the offset is 0.
i am also a beginner, could you suggest some good references? thank you
any suggestions please?
I am not able to move forward because of this single error!
Hi @omar11alhajj , sorry for the delay in getting back to you, been a bit busy this week.
Looking at what you have as your output from mmls, your contents look like they exist in slot 000, beginning at offset 2048. You can try the following command:
mountwin -o offset=$((2048*512)) ewf1 /mnt/windows_mount
Assuming you don't already have something mounted at /mnt/windows_mount
. Otherwise you can just change the mount point to something else and you should be good.
Hey @digitalsleuth
thanks a ton dude, it really worked.
but i still have a question(s):
thanks!
HI @omar11alhajj , in response to your questions above:
dd
to view the data at those offsets to carve or export that information out.I hope this helps!
thank you.
I cannot be more grateful.
Hello
I installed sift through official OVA download. then updated, but not upgraded. followed the official video in SIFT youtube. I got .E01 image of my own sandisk drive in NTFS. followed all instructions but when i get to mountwin ewf1 /mnt/windows_mount it throws this error: root@siftworkstation:/mnt/ewf_mount# mountwin ewf1 /mnt/windows_mount mount: /mnt/windows_mount: wrong fs type, bad option, bad superblock on /dev/loop0, missing codepage or helper program, or other error.
i tried .e01, dd images as well. i tried exfat, and ntfs system files as well.
no difference.