Setting up iscsi for F-Response

The excellent instructions available on Matt Shannons blog are a great guide to set up the iscsi protocol on a Linux computer and works extremely well. After following Matt's instructions I was still having an issue with the iscsi daemon failing to start on my box. After hours of pulling my hair out I discovered that the daemon relies on the iscsi_tcp module to be loaded into the kernel, in my case the support in the stock Ubuntu 8.04 kernel was missing and the support was not included, my choices were to recompile the current kernel 2.6.24-eeepc or to upgrade to Ubuntu 8.10. I decided it was time for an upgrade and after the install everything worked. It seems that the support in 8.04 was broken but was fixed in 8.10.

The process to get a connection to the F-Response tool in Ubuntu is shown below for completeness;

To install the open-iscsi packages



To start the iscsi service



Configure a new isicsi interface



Determine the MAC address of the network card we are going to bring to iscsi



To list the available iscsi devices on the F-Response host



To determine the device node on your local Linux box





We can then use the mount command to mount the file-system to allow us to browse, or use dd or any other tool to image or search the node.



If I am dealing with an NTFS file system I like to use the -o show_sys_files option so that I can have access to the NTFS internal system files $MFT etc.

I like to be able to copy off the MFT file and parse it using either MFT Ripper or Andy Rosens Grok-NTFS tools.

mount -t ntfs-3g -o loop,ro,show_sys_files,noexec,noatime /dev/sdd /mnt/evidence