03-20-2012
Download the mmls tool from TSK (The Sleuth Kit) and run it against your disk image. It will output the starting and ending sectors of each partition and its length. You can then use dd to carve out each partition from the disk image using a block size of 512, the skip option to skip forward to the start of particular partition and count option to specify the number of blocks to copy (length).
10 More Discussions You Might Find Interesting
1. Linux
Hi,
I was wondering if any of you guys know of way to make applications that use sound device on linux to access it in a "non-exclusive manner", the aim is to be able to use more than one application that requires the sound device.
Thanks (0 Replies)
Discussion started by: andryk
0 Replies
2. Linux
Hi,
we have running 8 box sles 9 cluster and on an nfs filesystem we have the problem which is grepped from /var/log/messages.
Jun 8 13:40:46 qnclpx02 kernel: attempt to access beyond end of device
Jun 8 13:40:46 qnclpx02 kernel: sdat: rw=0, want=8894615912, limit=314572800
Is there... (1 Reply)
Discussion started by: ortsvorsteher
1 Replies
3. UNIX for Dummies Questions & Answers
Hello everyone,
I write a program (Linux & Solaris) that will run as non-root user, but the program must have rw access to a device /dev/ipmi (on linux) or /dev/bmc (on solaris).
What is the standard way of granting such access?
Linux:
chmod on /dev/ipmi ?
suid root my program?
Solaris:... (1 Reply)
Discussion started by: Pavel.Bures
1 Replies
4. Homework & Coursework Questions
Problem statement.
In this part of the assignment, delegates will create a pseudo-device and write a device driver for it. The pseudo-device provides a “backdoor” for gaining root access for a particular user. Instead of compiling the device driver into the kernel, delegate will create a module.... (1 Reply)
Discussion started by: nyjilgeorge1
1 Replies
5. OS X (Apple)
hi, i am on a quest to access and even mount if possible a drive on os x. there is no driver for the device, but it lists fine in the system profiler. can i access its location from the terminal? how? here is what i get on the system profiler:
Speed: Up to 480 Mb/sec
Manufacturer: SAMSUNG
... (3 Replies)
Discussion started by: sontarieh
3 Replies
6. UNIX for Advanced & Expert Users
I am trying to load into the kernel a system-call dynamically (without restarting the kernel and compailing it) in an attempt to (once in kernel mode) write to user process's memory.
(I know there is a way to do this with the ptrace interface but it is not an option.)
I know the only way to... (1 Reply)
Discussion started by: hopelessProgram
1 Replies
7. Cybersecurity
Equipment: DJI Phantom 3
I have the root and passwords access, but I cannot find out how to access the equipment.
There is a USB port going to a miniUSB that connects to the equipment, but on Windows is detecting the connection as being a Serial Port (COM3).
I need some help in order to gain... (5 Replies)
Discussion started by: nobr3ga
5 Replies
8. Ubuntu
I cannot access or boot from my C drive. I'm running Zorin 9 and the drive is a Samsung SSD. The disk was encrypted on install, and that has not given me any problems before.
When I start the system it gets to the memory test page, and does not then load the password prompt, which it used to.... (1 Reply)
Discussion started by: David4321
1 Replies
9. UNIX for Dummies Questions & Answers
How to provide a client exclusive access to the NTP device or NTP server.
Example:
1. Configured md5 authentication for a subnet added below restriction line to the subnet as below in ntp.conf file. Also configured the keys and md5 authentication working .
restrict 192.168.1.0 mask... (1 Reply)
Discussion started by: iqtan
1 Replies
10. HP-UX
Hi,
Unable to make tape backup, please help.
/opt/ignite/bin/make_tape_recovery -a /dev/rmt/?mn -I -v -m tar -x inc_entire=vg00
* Creating local directories for configuration files and archive.
======= 04/25/16 16:28:08 IST Started /opt/ignite/bin/make_tape_recovery.
(Mon... (4 Replies)
Discussion started by: anuragr
4 Replies
MMCAT(1) General Commands Manual MMCAT(1)
NAME
mmcat - Output the contents of a partition to stdout
SYNOPSIS
mmcat [-t mmtype ] [-o offset ] [ -i imgtype ] [-b dev_sector_size] [-vV] image [images] part_num
DESCRIPTION
mmcat outputs the contents of a specific volume to stdout. This allows you to extract the contents of a partition to a separate file.
ARGUMENTS
-t mmtype
Specify the media management type. Use '-t list' to list the supported types. If not given, autodetection methods are used.
-o offset
Specify the offset into the image where the volume containing the partition system starts. The relative offset of the partition
system will be added to this value.
-b dev_sector_size
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or
512-bytes is assumed.
-i imgtype
Identify the type of image file, such as raw or split. If not given, autodetection methods are used.
-v Verbose output of debugging statements to stderr
-V Display version
image [images]
One (or more if split) disk images whose format is given with '-i'.
part_num
Address of partition to process. See the mmls output to determine the address of the partitions.
AUTHOR
Brian Carrier <carrier at sleuthkit dot org>
Send documentation updates to <doc-updates at sleuthkit dot org>
MMCAT(1)