Easily find your unmounted USB!

[scotty]

Using my linux build for forensic imaging is my main use of it. However, sometimes I find it difficult to track down the location of my usbs.

Sometimes your usb will unmount, and you will not be able to find it, or sometimes you need to find the actual path, for imaging, etc instead of the mounted path. Its so easy, here is what I do.

Unplug your usb.

Open up your terminal
cd /dev
ls -l

This will list all the files in that folder and the time they were modified.

Plug in your usb. Note the time. Say it's 07:01.

do ls -l again.

Scroll up the lists to everything started sd..

You will see sda sda1, etc etc, each one of these is a mount point for your usb. Find the one that matches your plug in time, and that is the full path to your usb as a whole.

Why is this useful? Well, if you need to recover a drive, or perform forensics, you need to access the full drive, so by accessing /dev/sdb instead of /media/mydrive you are accessing the drive as a drive, and not as a browsable folder. You you can complete dd images, scans, etc The same thing works for a usb that is unable to auto mount.

Thought maybe someone who is getting started would find this useful?

 

[ReMiXeDg]

Thanks for helpful information. I lost plenty of USB sticks before and hate it with a passion. I prefer using cloud file sharing then having to lost a 16 or 8 GB stick.


Sent from my iPad using tapatalk.
BackHost.US - Reliable Offshore Solutions.
Dedicated , VPS & Shared.
Skype: bh_Greg contact me for some deals!

 

[Famous]

Have you tried unmount name of drive at the command line? Other than that, I would probably just try restarting X (ctrl+alt+backspace).