Identify the distro with a(few) file(s)

PlatinumX · 08-28-2008, 10:14 AM

Hi all,

I received an hard-drive with an OS installed in it.

I need to identify the OS installed in the hard-drive without running it. (forbidden by the process).

I can mount it in readonly mode on another running sytem, but I can't boot directly on the hard-drive i received.

Which file(s) could help me to identify the OS installed on the hard-drive ?

Thanks

trickykid · 08-28-2008, 10:16 AM

If you can mount read-only, then mount the / directory and check in the /etc directory for a version file. It will usually be /etc/<vendor-name>-release

amani · 08-28-2008, 10:19 AM

use the system rescue cd or a forensic cd

... the files required will be clear only if you fix your list of possible OS(s).

pixellany · 08-28-2008, 10:26 AM

Do you mean which OS, or which Linux OS?

for Linux, you can also sometimes get a clue in the /boot directory, /var (eg the package manager file in /var/lib), or /lib/modules

salasi · 08-28-2008, 11:30 AM

This doesn't sound like a class lab to anyone else?

pixellany · 08-28-2008, 01:59 PM

Quote:

Originally Posted by salasi

This doesn't sound like a class lab to anyone else?

Does not fit the pattern of the typical homework troll---but you could still be right.

trickykid · 08-28-2008, 02:08 PM

Quote:

Originally Posted by pixellany

Does not fit the pattern of the typical homework troll---but you could still be right.

Who cares, it's not against the rules. The rules state to not expect answers at least in a direct sense. So you can choose to ignore if you think it's homework.

PlatinumX · 08-29-2008, 06:53 AM

Code:

Do you mean which OS, or which Linux OS?

It is a Windows admin who gave me this, and told me it is a Unix system.

However, as he is not into Uix/Linux, he is not making any difference in between them.

However, i noticed the filesystem is a 44BSD: so it could be open/net/free bsd.

I am not used of BSD systems.
You know how I can recognize which system is installed ?

Thanks

tredegar · 08-29-2008, 01:22 PM

Quote:

I need to identify the OS installed in the hard-drive without running it. (forbidden by the process).

I think we need to know more about this. Exactly why is it "forbidden"?

If it's a forensic analysis you are looking for, then say so. I may be able to help, as I have had some success with this sort of thing in the past.

PlatinumX · 09-02-2008, 01:18 PM

Code:

Exactly why is it "forbidden"?

You can corrupt the system by getting it online.
To understand what is wrong in the system hosted in the hard-drive, you need the keep the system as it was when it crashed.