Our first move however, is to mount the disk. To mount let's first create a folder name "WIN10-disk" in our current folder
$ mkdir WIN10-disk
Next up let's mount the disk
$ sudo mount --verbose --types ntfs --read-only /dev/sdb2 WIN10-disk/
Verifying the disk has been successfully mounted
$ df -kh Filesystem Size Used Avail Use% Mounted on udev 981M 0 981M 0% /dev tmpfs 201M 12M 189M 6% /run /dev/sda1 79G 58G 18G 77% / tmpfs 1001M 128K 1000M 1% /dev/shm tmpfs 5.0M 4.0K 5.0M 1% /run/lock tmpfs 1001M 0 1001M 0% /sys/fs/cgroup tmpfs 201M 60K 200M 1% /run/user/1000 /dev/sdb2 30G 23G 6.7G 78% /home/sansforensics/WIN10-disk
Looks good. As above we see the "/dev/sdb2 30G 23G 6.7G 78% /home/sansforensics/WIN10-disk"
Performing a "ls"
$ ls /home/sansforensics/WIN10-disk/ Documents and Settings PerfLogs Program Files Recovery swapfile.sys tmp WebGoat xampp pagefile.sys ProgramData Program Files (x86) $Recycle.Bin System Volume Information Users Windows
Looks good enough at this point. No need for us to go further.
Let's switch to the next post on memory.
No comments:
Post a Comment