Sunday, November 30, 2008

Forensics: Filesystem Mount

To see the list of devices detected  by linux, type
ls /dev

Usually, hard disk partitions are labeled sda, sda1, hda, etc

To mount these partitions, first make a path where these partitions are to be accessed.
Eg mkdir  /mnt/mywindrive or sudo mkdir /mnt/mywindrive

Then, associate the device with the mount location.
sudo mount -o ro -t auto /dev/sda1 /mnt/mywindrive

*Taken from Unix and Linux Forensic Analysis DVD Toolkit 

No comments: