I have a FORMAT statement just after the osfmount command, but a soon get a pop-up asking me to format the RD anyway. ![]() I decided to try creating a batch script using your CLI to get the process going, but I'm having an issue where OSFMount is "Notifying applications.". ![]() Often I end up mounting a ram drive, and I'd like to speed up the process of doing so. When mounted with FTK, it is 11.721.045.168 Sectors long instead.First, I'd like to express my sincere gratitude for making OSFMount available for free. If I browse to that offset, I begin getting errors. According to R-Studio, it's reported as 1.46 TB, or 3.131.110.576 Sectors. OSFMount also successfully shows the first part of the disk. It successfully lets me browse the end of the image. It can open it, and mount it (I was able to browse the partition after I wrote the first post). I'm not sure if OSForensics can open it, as I've never used that tool before. It basically reports back "Parameter is incorrect" for each sector being read. It does however, see a partition sized 5.45 TB - but when I browse this partition in R-Studios hex editor, and move towards the end, I get the error output shown below the listing. ![]() R-Studio indicates its size (top right) as 1.46 TB. In picture 2, it's been mounted and browsed in R-Studio. In step 4, I choose defaults, and then I mount it. In picture 1, we can see it detects partitions, one of which is 5.45 TB. When opened in OSFMount (which also takes a while - but FTK does this too, so that's probably just E01 for me).
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |