A useful write-up on drive letter assignments can be found, unsurprisingly, in Wikipedia. Thus, if the user of the forensic application is able to let the application know the order of physical disks that the images relate to, it should be possible to logically work out the order in which drive letters are initially assigned.
Windows does, however, give users the option of altering drive letters; NTFS 3 also allows drives to be given 'mount points' within the filesystem. And of course the various Unix variants don't use drive letters at all. Therefore, for Windows drives we also need access to the registry in order to work out these additional issues; for Linux, the main configuration files (probably /etc/fstab).
Thursday 29 October 2009
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment