Veritas

Dear TCT-Users,

I have to analyze a disk previously installed within a Solaris 9 box. It lo=
oks=20
like the disk contains Veritas depending partitions.


=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=20

prtvtoc /dev/dsk/c1t1d0s0
* /dev/dsk/c1t1d0s0 partition map
*
* Dimensions:
*     512 bytes/sector
*     424 sectors/track
*      24 tracks/cylinder
*   10176 sectors/cylinder
*   14089 cylinders
*   14087 accessible cylinders
*
* Flags:
*   1: unmountable
*  10: read-only
*
* Unallocated space:
*       First     Sector    Last
*       Sector     Count    Sector
*     6298944 18446744073703252672 18446744073709551615
*   143349312 18446744073572501248   6298943
*    35677056     20352  35697407
*
*                          First     Sector    Last
* Partition  Tag  Flags    Sector     Count    Sector  Mount Directory
       0      2    00          0   6298944   6298943   /mnt/evidence
       1      3    01    6309120  25165248  31474367
       2      5    00          0 143349312 143349311
       3      7    00   31474368   4202688  35677055
       4     15    01    6298944     10176   6309119
       6     14    01          0 143349312 143349311
       7      0    00   35697408 107651904 143349311


=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=20

Tag 14 and 15 are defined as Veritas tags
http://seer.support.veritas.com/docs/234361.htm


=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

The mount command disclosed the following information

=46ilesystem Mounted
/dev/vx/dsk/rootvol /
/proc /proc
fd /dev/fd
mnttab /etc/mnttab
/dev/vx/dsk/var /var
swap /var/run
swap /tmp
/dev/vx/dsk/local /local
/dev/vx/dsk/raiddg3/raid3vol /raid3
/dev/vx/dsk/raiddg4/raid4vol /raid4
/dev/vx/dsk/raiddg9/raid9vol /raid9

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D


I would like to do a MACTIME analysis using tct or sleuthkit. Any ideas how=
 to=20
proceed, because the veritas cluster partition stops further investigation.=
=20

Regards

Ivan

=2D-=20
_____________________________________________________________

Ivan Buetler
Compass Security Network Computing AG
Gl=E4rnischstrasse 7, CH-8640 Rapperswil, Switzerland

 Tel +41 55 214 41 62
 Fax +41 55 214 41 61
 [email protected]
 http://www.csnc.ch

 PGP: 539D 2C1B F338 66C6 AD00  ABB9 68B5 4976 2E9A 98EA

 Security Review - Penetration Testing - Computer Forensics

_____________________________________________________________