May be a bug in Caine 1.5?

[takitano]

My colleague could not run 2 different computers (1 PC and 1 notebook) with a Caine live-Cd in graphical mode. The boot process always remained standing.

[198.911520] ata6: COMRESET failed (eerno=-16)
[198.911559] ata6: reset failded, giving up
[198.911603] ata6: EH complete

After about 10 minutes nothing happened. With the DEFT v5 CD all works.

PC: Asus A8N-SLi Premium Motherboard, BIOS 5.1.3.9, 4 GB DDRII RAM, 2 SATA HDD (2x 500 GB) - no RAID, 1 DVD-Writer LG GSA-H10N, Windows XP Professional SP3, Athlon Dual Core Processor
Notebook: Noname, Windows Vista, Intel Processor, CD-ROM
Unfortunately, he knew nothing.

On my machine and on a different computer with the same motherboard, works the Caine-CD in graphical mode.

[nannib]

No it's not a bug...I guess it's simply a problem of Ubuntu, for this reason it's better always to carry more live distro, because it can happen that some hardware is not recognized.
In any case, did you try to boot in Text Only mode?
See this:

http://www.google.it/search?sourceid=navclient&hl=it&ie=UTF-8&rlz=1T4GGIH_itIT218IT218&q=ata6%3a+COMRESET+failed+%28eerno%3d-16%29
There are many reason for that kind of error, on many distro...
Thanks
bye

[takitano]

For me, the cd also works in the text mode. My colleague will test next week too. It really seems to be a Ubuntu (I hope only in 8.04/earlier and not in 8.10/later?) problem.
Thank you.

[nannib]

It's an Ubuntu problem...we wait for the next LTS to update

[takitano]

So. My colleague has now tried the text mode. The PC will not boot. By the way - the computer seems to be wrong, because even Windows does not boot. But with DEFT5 CD you can't boot now too. The Notebook boot in the text mode with Caine1.5 CD.

[denis]

well! it's enough to made a forensic image using dd, dcfldd, dc3dd, ewfacquire or aimage....a wide choice. You can also connect sospected pc to another warkstation using crox cable, run autopsy on sospected and see results on the other.

[takitano]

Thanks for the tips, Denis. But he wanted only to live examine the computer without forensical imaging. Ok. In this case, it was impossible to do. You can not have everything precisely.

[denis]

impossible? why? if suspected pc boot with caine in text mode then you can preview that host accross network with Autopsy!

look the picture!
look the address box! http://10.0.0.2/etc../autopsy !
it's Autopsy running on a old machine in which Caine start in text mode only!
You can preview a machine in this way, with Caine intext mode only.
This afternoon I'll write a post non my blog about it.

Regardes

update h 23.00 04/12/2009 post on blog "preview booting in text mode" http://www.denisfrati.it/?p=1763

[takitano]

impossible? why? if suspected pc boot with caine in text mode then you can preview that host accross network with Autopsy!
You can preview a machine in this way, with Caine intext mode only.

Hello Deniis,
you have misunderstood me. My question relates to a graphical boot mode. Nannib asked me to boot this pc with text mode. It was not possible. The hard drive was broken. And on a broken hard drive you can't do any live analysis.
Nevertheless, thanks for the manual!

[denis]

I apologize for my mistake

[Sponsored content]