Logicube Forensic Falcon™ User’s Manual 105
7: Viewing EXT4 formatted Destination drives in Windows
7.0 Viewing EXT4 formatted Destination drives – Introduction
The Falcon formats Destination drives using the NT File System (NTFS) or EXT4 file system. Linux
Operating Systems have native support for EXT4 file systems. Windows, however, does not have
native support for viewing the EXT4 file system. There are several utilities that allow viewing of
the EXT4 file system in Windows. Ext2Fsd (http://www.ext2fsd.com/) is a free, open source
utility driver allows EXT3 and EXT4 partitions to be viewable in Windows.
The Falcon labels the formatted Destination drive as “REPOSITORY”.
Logicube does not provide full support for Ext2fsd. We provide basic instructions on how to
make this utility work in our scenario. For Ext2fsd support, please visit their website above.
7.0.1 Step-by-step instructions – Using Ext2fsd
1. Download and install Ext2fsd from the website above. If Ext2fsd is
already installed, skip to step 2.
After installing Ext2fsd, reboot the computer.
2. Connect the Destination drive to the computer. The Falcon can be used
to view the Destination drive. See Sections 3.6 and 6.0.6 for more
information. Alternatively, other methods can be used to connect the
drive to the computer (e.g. a write block device).
There are times when Windows will auto-assign a drive letter to
the drive. If it auto-assigns a drive letter at this point, continue
with the analysis process. There is no need to follow the other
steps in these instructions. If Windows does not auto-assign a
drive letter, open Ext2fsd’s Ext2 Volume Manager program.
3. Locate the Destination drive. The Destination drive should have a RAW
“Partition type”.
To Next Page
Loading...
Need help?
General
