Read Mac OS file in Linux

vrsixer · 06-29-2005, 10:17 AM

Here's the short story: performing forensics on a Mac harddrive. It's connected via a IDE to USB cable on a DELL D800 laptop. The laptop is running Suse 9.3. I mounted the harddrive to /mnt/mac. It's HFS, not HFS+ BTW.

Anyway, now I'm trying to browse the files on the harddrive. I see 5 files (not folders). Desktop DB, Desktop DF, Finder, System, and "Where have all my files gone". Suse shows these as "unknown" type. So my question is, how can I browse this drive as a normal drive, like I would function on the Mac???

SciYro · 06-29-2005, 10:24 AM

are you sure they are not directories?, what does "file" say about there types

vrsixer · 06-29-2005, 10:29 AM

They all report as "empty".

SciYro · 06-29-2005, 11:10 AM

"empty"? ...... what program said that?

vrsixer · 06-29-2005, 11:30 AM

"file" ran the following command: ":/mnt/mac # file System" returned "System: empty"

SciYro · 06-30-2005, 10:01 AM

can you give all the output, including the complete command you typed, I'm not sure weather you typed ":/mnt/mac # file System", or if that was output.

vrsixer · 07-01-2005, 07:49 AM

at the command prompt, I typed "file System"
it returned "System: empty"

SciYro · 07-01-2005, 08:37 AM

that would mean it thinks its a empty file, dont know what thats doing there, but, what of the others?