Caine 2.5.1: Mounter GUI utility does not mount ext3 volumes

[korba]

Hi,

I have been trying to mount an USB drive with just one ext3 (/dev/sdb1) partition by using the "mounter" GUI utility but after selecting the devide and clinking on "OK" button, the system does not mount the device. I have been trying to find some logs by looking at /var/log directory (ls -ltr /var/log) but after pressing the OK button, there is not any file updated under that directory.

I am running Caine in virtual machine (VMware workstation 7) and I tried with the LIVE boot and installing CAINE in the virtual machine, however in booth case I am not able to mount the ext3 file system.

To verify that there is not a problem with the USB drive I done the following:
sudo su -
mkfs.ext2 /dev/sdb1

and after formatting in ext2, I am able to mount the sdb1 partition by using "mounter" ...but only when is formatted with ext2.

Could you help me?

Thanks,
Jose

[nannib]

Yes it's a bug of rbfstab, you can mount ext3 in read only mode using the console...or you have to edit rbfstab located in /usr/sbin
and edit the options in this way:
## default read-only options
OPTIONS="ro,noauto,noexec,nodev,noatime"
and
ext3) OPTIONS="${OPTIONS}" ;;
bye

[korba]

Hi Nanni,

Thanks for your help, now it is working.

The first line was right but for the second one, I have to change
ext3) OPTIONS="${OPTIONS},noload" ;;

by:
ext3) OPTIONS="${OPTIONS}" ;;

With this change the USB drive is mounted with the following parameters:
/dev/sdb1 on /media/sdb1 type ext3 (ro,noexec,nodev,noatime)

However having a look at mount man page I have found the following:
"you may want to mount ext3 or ext4 fielsystem with ro,nolad mount options ...to read-only mode"
...
"noload Do not load the ext3 filesystem's journal on mounting"

As I did not understand the reason to remove the "nolad" option, I tried to execute the mount comand with the ro,noauto,noexec,nodevnoatime,nolad option from the terminal, but I got the "wrong fs type, bad option.." error message.
After reading the following article, computer-forensics.sans.org/blog/2011/06/14/digital-forensics-mounting-dirty-ext4-filesystems, I tried to execte the mount command with the previous options but changing the file system to ext4. This time it worked.

So I have change the following
ext3) OPTIONS="${OPTIONS},noload" ;;
by
ext3) FSTYPE="ext4"; "${OPTIONS},noload" ;;

Do you think it is safer than your suggestion?
Thank you so much for your help and time.
Jose

[nannib]

Yes thank you this could be better...I read here:
http://computer-forensics.sans.org/blog/2011/06/14/digital-forensics-mounting-dirty-ext4-filesystems
Thanks again I change in that way after a testing time :-)
bye

[Sponsored content]