0

i'm trying to search a student device with CAINE. I'm trying to pull an image of the drive for analysis, first I'm trying to mount an external USB hard drive sdb with read and write privileges so I can write to it and copy the image with Guymager tool. If i just try to mount with CAINE it automatically write protects anything.

I've tried first as root user: mkdir /media/forensicA Then: mount -o rw /dev/sdb /media/forensicA

but I get this error:

"wrong fs type, bad option, bad superblock on /dev/sdb/, missing codepage or helper program, or other error"

Trying to mount a NTFS Win 10 partition, booting of a live USB of CAINE.

  • 2
    If the USB hard drive has a partition table you might have to mount /dev/sdb1 (for the first partition) instead of /dev/sdb? – Bodo Feb 18 at 14:43
  • Make sure that you never mount the target device with write access. To be frank: if this is serious digital forensics, having the evidence handled by someone who does not even know how to mount a disc is not really help at all, and is actually a liability. – JdeBP Feb 18 at 15:25
0

Try mount -t ntfs /dev/sdbX /media/forensicA and replace X with your partition number (1 for the first partition, 2 for the second,...)

  • I'd use ntfs3g instead and also be sure ntfs3g is installed. ntfs only won't let OP write – DDS Feb 18 at 15:12
  • Yes, ntfs-3g should be installed. On my Debian -t ntfs and -t ntfs-3g is the same (fuseblk mounted in rw). – Freddy Feb 18 at 15:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.