determining filesystem type in an image

[Don Raikes]

Hello,

I am running TSK in a debian lenny system, and have several dd images of floppies/usb keys.  I am wondering what the best way is to determine the filesystem/partition types are included in the dd images.

For example: I have 2 dd images of floppies. I want to know what filesystem was on the floppies to begin with. I tried mmls but it said "cannot determine partition type".

For the usb keys, mmls does give me a lot of information.

Any tips would be appreciated.

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

[RB-14]

On Fri, Aug 21, 2009 at 10:11, Don Raikes<DON.RAIKES@...> wrote:
> I am running TSK in a debian lenny system, and have several dd images of floppies/usb keys.  I am wondering what the best way is to determine the filesystem/partition types are included in the dd images.

To determine partition types (as you noted lower), you'd use 'mmls'.
For filesystem types, use 'fsstat' against the individual partitions.

> For example: I have 2 dd images of floppies. I want to know what filesystem was on the floppies to begin with. I tried mmls but it said "cannot determine partition type".

Floppies generally don't have a partition table (which mmls examines)
- I just verified this with a known-good floppy that has a FAT12
filesystem across the entire image.  Use 'fsstat' to get the
filesystem information.

> For the usb keys, mmls does give me a lot of information.

Meaning you got the partition table as well.

Another useful tool for quick identification of partitions and
filesystems is 'disktype' - it will handle both partition and
whole-disk images, and dumps out terse (but useful) identification of
each.

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org