We're making some progress but no success yet.
The windows tool has not been updated for some time and does not support the version of QNX we are looking at.
SANS SIFT dosen't appear to support it. I've tried mounting the image and viewing in Autopsy but no joy. I Haven't tried installing the kernal patch yet though. The next plan is to restore the image onto a drive and connect it to Ubuntu with the patch in place.....
QNX forum is pretty good though. Another suggestion is to live boot a QNX OS with a copy of the suspect drive attached.
A learning curve to say the least......
↧