PDA

View Full Version : Forensic Boot Mode & Mounting with '-w' Option



hoyt.harness
11-13-2012, 01:01 AM
Knoppix 7.0.4

I really like data recovery from an evidence drive with Knoppix using the forensic cheatcode ('knoppix forensic'), however I can't seem to mount a destination drive and make it writable. Using a terminal with "sudo mount -w /dev/sd_ /media/sd_" still doesn't allow writes to that drive. Using the '-o rw' option yields the same results as would be expected. So...

1. What must be done to make a drive writable with Knoppix in forensic mode?

2. Where can I find documentation on which boot options are invoked with the 'forensic' cheatcode?

I have searched the forum and have not found these answers.

Thanks in advance!