±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36595
New Yesterday: 4 Visitors: 107

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Novelle File System

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

akaplan0qw9
Senior Member
 

Novelle File System

Post Posted: Sep 15, 06 23:52

Has anybody on here had any first hand exerience with FTK and the Ftk Imager, reading, imaging and processing drives on a Novelle server.

I have a delicate situation and I'm not in a position to access the HDs in a Novelle Server without knowing in advance if I will be able to read, image or process them.

Thanks!
_________________
Alan M. Kaplan, ACE
Nevada PI License #220
AKaplan @ LasVegasPI.com 
 
  

keydet89
Senior Member
 

Re: Novelle File System

Post Posted: Sep 16, 06 03:19

Imaging really isn't so much of an issue. I've used FTK to image a FreeBSD server, then opened it in EnCase as a UFS volume.

As far as processing the Novell file system, I'd (a) check to see what version they're running, and (b) contact AccessData directly via the phone.

H  
 
  

akaplan0qw9
Senior Member
 

Re: Novelle File System

Post Posted: Sep 16, 06 03:25

Thanks!!
_________________
Alan M. Kaplan, ACE
Nevada PI License #220
AKaplan @ LasVegasPI.com 
 
  

echo6
Senior Member
 

Re: Novelle File System

Post Posted: Sep 24, 06 16:00

Acquiring an image won't be a problem, but viewing the file system using either EnCase or FTK will be as neither currently have support for Novell file system. Captain Nemo www.runtime.org/captain.htm has support for it however.  
 
  

keydet89
Senior Member
 

Re: Novelle File System

Post Posted: Sep 24, 06 16:23

echo6,

Beware using the software, though. If you image the Novell system, you'll have to restore that image to another drive so that you can then mount it under whichever OS you're using; make sure to (a) use a write blocker, and (b) never work on the original evidence.

Capt Nemo is NOT a version of EnCase or FTK that allows you to access the Novell file system...it's more of a version of Windows Explorer.  
 

Page 1 of 1