0

i'm trying to search a student device with CAINE. I'm trying to pull an image of the drive for analysis, first I'm trying to mount an external USB hard drive sdb with read and write privileges so I can write to it and copy the image with Guymager tool. If i just try to mount with CAINE it automatically write protects anything.

I've tried first as root user: mkdir /media/forensicA Then: mount -o rw /dev/sdb /media/forensicA

but I get this error:

"wrong fs type, bad option, bad superblock on /dev/sdb/, missing codepage or helper program, or other error"

Trying to mount a NTFS Win 10 partition, booting of a live USB of CAINE.

Improve this question
2
  • 3
    If the USB hard drive has a partition table you might have to mount /dev/sdb1 (for the first partition) instead of /dev/sdb?
    – Bodo
    Feb 18, 2019 at 14:43
  • Make sure that you never mount the target device with write access. To be frank: if this is serious digital forensics, having the evidence handled by someone who does not even know how to mount a disc is not really help at all, and is actually a liability.
    – JdeBP
    Feb 18, 2019 at 15:25

1 Answer 1

Reset to default
0

Try mount -t ntfs /dev/sdbX /media/forensicA and replace X with your partition number (1 for the first partition, 2 for the second,...)

Improve this answer
2
  • I'd use ntfs3g instead and also be sure ntfs3g is installed. ntfs only won't let OP write
    – DDS
    Feb 18, 2019 at 15:12
  • Yes, ntfs-3g should be installed. On my Debian -t ntfs and -t ntfs-3g is the same (fuseblk mounted in rw).
    – Freddy
    Feb 18, 2019 at 15:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .