1

Using dcfldd, I have imaged one disk of a win10 mirrored volume.

Autopsy does not recognize it as an NTFS file system, but instead shows "SFS" or "secure file system".

The target machine is, indeed, using NTFS. My guess is that because this is a dynamic volume with mirroring enabled, it doesn't recognize it properly.

I still have access to the raw disk, but really need to be able to do file analysis as well.

Autopsy complains with this error:

Invalid magic value (Not a NTFS file system (magic))

How do I fix this so Autopsy can do file analysis?

Here's the output of blkcat -hwv -o 63 sdb.dd 0

1

If the drive is using Logical Disk Management and you acquired the physical drive (instead of the logical drive presented by Windows), then Autopsy won't know how to interpret it. It doesn't currently have LDM support.

0

Use EnCase instead of using dcfldd. It is the industry standard for Computer Forensics.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.