12
Jan

In Linux, file systems are generally mounted by root unless non-root users are given permission in the /etc/fstab file. If you are performing an analysis and need to mount a raw file system (dd image) for review, you can issue the following command as root:

mount -t ntfs -o ro,loop,show_sys_files,offset=32256,umask=222 /cases/case-sense-net/tag1/tag1-img.dd /cases/fs-readonly

The will mount the image file (generated by dd, dcfldd, dc3dd, etc.) in /cases/fs-readonly and will allow non-root users to view all of the files and directories. The key is the umask=222 which sets the permissions on the mount file sytem to 0444, or read-only for all users but able to change into subdirectories.

  • Share/Bookmark
Category : Computer Forensic HOWTOs

You must be logged in to post a comment.