Mount external USB drive
Clash Royale CLAN TAG#URR8PPP
i'm trying to search a student device with CAINE. I'm trying to pull an image of the drive for analysis, first I'm trying to mount an external USB hard drive sdb with read and write privileges so I can write to it and copy the image with Guymager tool. If i just try to mount with CAINE it automatically write protects anything.
I've tried first as root user: mkdir /media/forensicA
Then: mount -o rw /dev/sdb /media/forensicA
but I get this error:
"wrong fs type, bad option, bad superblock on /dev/sdb/, missing codepage or helper program, or other error"
Trying to mount a NTFS Win 10 partition, booting of a live USB of CAINE.
mount
edited Feb 18 at 15:14
Rui F Ribeiro
41.5k1482140
asked Feb 18 at 14:40
KVMKVM
1
add a comment |
i'm trying to search a student device with CAINE. I'm trying to pull an image of the drive for analysis, first I'm trying to mount an external USB hard drive sdb with read and write privileges so I can write to it and copy the image with Guymager tool. If i just try to mount with CAINE it automatically write protects anything.
I've tried first as root user: mkdir /media/forensicA
Then: mount -o rw /dev/sdb /media/forensicA
but I get this error:
"wrong fs type, bad option, bad superblock on /dev/sdb/, missing codepage or helper program, or other error"
Trying to mount a NTFS Win 10 partition, booting of a live USB of CAINE.
mount
edited Feb 18 at 15:14
Rui F Ribeiro
41.5k1482140
asked Feb 18 at 14:40
KVMKVM
1
2
If the USB hard drive has a partition table you might have to mount/dev/sdb1(for the first partition) instead of/dev/sdb?
– Bodo
Feb 18 at 14:43
Make sure that you never mount the target device with write access. To be frank: if this is serious digital forensics, having the evidence handled by someone who does not even know how to mount a disc is not really help at all, and is actually a liability.
– JdeBP
Feb 18 at 15:25
add a comment |
i'm trying to search a student device with CAINE. I'm trying to pull an image of the drive for analysis, first I'm trying to mount an external USB hard drive sdb with read and write privileges so I can write to it and copy the image with Guymager tool. If i just try to mount with CAINE it automatically write protects anything.
I've tried first as root user: mkdir /media/forensicA
Then: mount -o rw /dev/sdb /media/forensicA
but I get this error:
"wrong fs type, bad option, bad superblock on /dev/sdb/, missing codepage or helper program, or other error"
Trying to mount a NTFS Win 10 partition, booting of a live USB of CAINE.
mount
edited Feb 18 at 15:14
Rui F Ribeiro
41.5k1482140
asked Feb 18 at 14:40
KVMKVM
1
i'm trying to search a student device with CAINE. I'm trying to pull an image of the drive for analysis, first I'm trying to mount an external USB hard drive sdb with read and write privileges so I can write to it and copy the image with Guymager tool. If i just try to mount with CAINE it automatically write protects anything.
I've tried first as root user: mkdir /media/forensicA
Then: mount -o rw /dev/sdb /media/forensicA
but I get this error:
"wrong fs type, bad option, bad superblock on /dev/sdb/, missing codepage or helper program, or other error"
Trying to mount a NTFS Win 10 partition, booting of a live USB of CAINE.
mount
mount
edited Feb 18 at 15:14
Rui F Ribeiro
41.5k1482140
asked Feb 18 at 14:40
KVMKVM
1
edited Feb 18 at 15:14
Rui F Ribeiro
41.5k1482140
asked Feb 18 at 14:40
KVMKVM
1
edited Feb 18 at 15:14
Rui F Ribeiro
41.5k1482140
edited Feb 18 at 15:14
Rui F Ribeiro
41.5k1482140
edited Feb 18 at 15:14
Rui F Ribeiro
41.5k1482140
41.5k1482140
asked Feb 18 at 14:40
KVMKVM
1
asked Feb 18 at 14:40
KVMKVM
1
asked Feb 18 at 14:40
KVMKVM
1
1
2
If the USB hard drive has a partition table you might have to mount/dev/sdb1(for the first partition) instead of/dev/sdb?
– Bodo
Feb 18 at 14:43
Make sure that you never mount the target device with write access. To be frank: if this is serious digital forensics, having the evidence handled by someone who does not even know how to mount a disc is not really help at all, and is actually a liability.
– JdeBP
Feb 18 at 15:25
add a comment |
2
If the USB hard drive has a partition table you might have to mount/dev/sdb1(for the first partition) instead of/dev/sdb?
– Bodo
Feb 18 at 14:43
Make sure that you never mount the target device with write access. To be frank: if this is serious digital forensics, having the evidence handled by someone who does not even know how to mount a disc is not really help at all, and is actually a liability.
– JdeBP
Feb 18 at 15:25
2
2
If the USB hard drive has a partition table you might have to mount
/dev/sdb1 (for the first partition) instead of /dev/sdb?– Bodo
Feb 18 at 14:43
If the USB hard drive has a partition table you might have to mount
/dev/sdb1 (for the first partition) instead of /dev/sdb?– Bodo
Feb 18 at 14:43
Make sure that you never mount the target device with write access. To be frank: if this is serious digital forensics, having the evidence handled by someone who does not even know how to mount a disc is not really help at all, and is actually a liability.
– JdeBP
Feb 18 at 15:25
Make sure that you never mount the target device with write access. To be frank: if this is serious digital forensics, having the evidence handled by someone who does not even know how to mount a disc is not really help at all, and is actually a liability.
– JdeBP
Feb 18 at 15:25
add a comment |
1 Answer
1
active
oldest
votes
Try mount -t ntfs /dev/sdbX /media/forensicA and replace X with your partition number (1 for the first partition, 2 for the second,...)
answered Feb 18 at 14:49
FreddyFreddy
1,319110
I'd usentfs3ginstead and also be sure ntfs3g is installed.ntfsonly won't let OP write
– DDS
Feb 18 at 15:12
Yes,ntfs-3gshould be installed. On my Debian-t ntfsand-t ntfs-3gis the same (fuseblk mounted in rw).
– Freddy
Feb 18 at 15:22
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f501373%2fmount-external-usb-drive%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Try mount -t ntfs /dev/sdbX /media/forensicA and replace X with your partition number (1 for the first partition, 2 for the second,...)
answered Feb 18 at 14:49
FreddyFreddy
1,319110
I'd usentfs3ginstead and also be sure ntfs3g is installed.ntfsonly won't let OP write
– DDS
Feb 18 at 15:12
Yes,ntfs-3gshould be installed. On my Debian-t ntfsand-t ntfs-3gis the same (fuseblk mounted in rw).
– Freddy
Feb 18 at 15:22
add a comment |
Try mount -t ntfs /dev/sdbX /media/forensicA and replace X with your partition number (1 for the first partition, 2 for the second,...)
answered Feb 18 at 14:49
FreddyFreddy
1,319110
I'd usentfs3ginstead and also be sure ntfs3g is installed.ntfsonly won't let OP write
– DDS
Feb 18 at 15:12
Yes,ntfs-3gshould be installed. On my Debian-t ntfsand-t ntfs-3gis the same (fuseblk mounted in rw).
– Freddy
Feb 18 at 15:22
add a comment |
Try mount -t ntfs /dev/sdbX /media/forensicA and replace X with your partition number (1 for the first partition, 2 for the second,...)
answered Feb 18 at 14:49
FreddyFreddy
1,319110
Try mount -t ntfs /dev/sdbX /media/forensicA and replace X with your partition number (1 for the first partition, 2 for the second,...)
answered Feb 18 at 14:49
FreddyFreddy
1,319110
answered Feb 18 at 14:49
FreddyFreddy
1,319110
answered Feb 18 at 14:49
FreddyFreddy
1,319110
answered Feb 18 at 14:49
FreddyFreddy
1,319110
1,319110
I'd usentfs3ginstead and also be sure ntfs3g is installed.ntfsonly won't let OP write
– DDS
Feb 18 at 15:12
Yes,ntfs-3gshould be installed. On my Debian-t ntfsand-t ntfs-3gis the same (fuseblk mounted in rw).
– Freddy
Feb 18 at 15:22
add a comment |
I'd usentfs3ginstead and also be sure ntfs3g is installed.ntfsonly won't let OP write
– DDS
Feb 18 at 15:12
Yes,ntfs-3gshould be installed. On my Debian-t ntfsand-t ntfs-3gis the same (fuseblk mounted in rw).
– Freddy
Feb 18 at 15:22
I'd use
ntfs3g instead and also be sure ntfs3g is installed. ntfs only won't let OP write– DDS
Feb 18 at 15:12
I'd use
ntfs3g instead and also be sure ntfs3g is installed. ntfs only won't let OP write– DDS
Feb 18 at 15:12
Yes,
ntfs-3g should be installed. On my Debian -t ntfs and -t ntfs-3g is the same (fuseblk mounted in rw).– Freddy
Feb 18 at 15:22
Yes,
ntfs-3g should be installed. On my Debian -t ntfs and -t ntfs-3g is the same (fuseblk mounted in rw).– Freddy
Feb 18 at 15:22
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f501373%2fmount-external-usb-drive%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
2
If the USB hard drive has a partition table you might have to mount
/dev/sdb1(for the first partition) instead of/dev/sdb?– Bodo
Feb 18 at 14:43
Make sure that you never mount the target device with write access. To be frank: if this is serious digital forensics, having the evidence handled by someone who does not even know how to mount a disc is not really help at all, and is actually a liability.
– JdeBP
Feb 18 at 15:25