I have been recently working with VMware to create a virtual machine of a Linux computer running Ubuntu for an upcoming training workshop. However, I found that I could not get EnCase or FTK Imager to parse the filesystem correctly and both products were unable to show the folder structure correctly.
After many attempts at mounting and converting the VMDK file I was still unable to correct the issue. My first thoughts were that maybe Ubuntu was using an LVM (EnCase and FTK Imager do not support Linux LVM), but the filesystem as I expected was Ext3.
Over on the Digital Detective message board I found that another person was having the same issue and after they had spoke to GSI and Accessdata the problem was identifed ( not resolved) as being;
"......the problem seems to be that sector 63 on an Ubuntu 8.10 system is different to usual...it's empty!"
Therefore is seems that sector 63 on a Ubuntu 8.10 system contains a null character that prevents the programs identifying the Ext 3 filesystem.
Thankfully both Linux and SMART is able to read the files correctly.
This comment has been removed by the author.
ReplyDeleteThe LVM issue is a common one and worth noting. It is frequently becoming common to find Linux installations with this present as many distros now offer this as a default installation option.
ReplyDeleteI've seen many forensic investigators get confused by its presence.
You can easily identify the presence of LVM by its signature, usually "LVM2" LOL
When I get time I mean to blog about these issues and document some procedures to tackle LVM volumes.