I read Linegod's article on Cisco VPN client and decided to share some useful tips/info on my experiences with FC4 x86_64 on my laptop.

This topic would be better in a security or multimedia section, but here it is in the AMD64 Topic section...

I have been studying digital forensics and came across a kernel module called cdfs that allows you to mount multiple sessions from a cd. I was working on a test forensics problem involving a multi-session cd that would only mount one of three sessions from the evidence media.

I visited http://www.elis.rug.ac.be/~ronsse/cdfs/ the homepage for cdfs and downloaded the source: http://www.elis.rug.ac.be/~ronsse/cdfs/download/cdfs-2.6.12.tar.bz2

The original kernel for FC4 x86_64 would not compile this module correctly (or any other version I tried!) , but upgrading to 2.6.14-1.1644_FC4 did the trick.

I extracted the archive, ran make, make install and then modprobe cdfs to load the module, as clearly explained in the INSTALL file. After loading the module, I mounted the evidence media with:

# mount -t cdfs -o ro /dev/hdc /mnt/cdrom

I then did a ls -l /mnt/cdrom and found 3 iso images in the directory. I mounted the iso files to 3 seperate directories:

# mount -t iso9660 -o ro,noatime,loop session1.iso /mnt/loop1
# mount -t iso9660 -o ro,noatime,loop session2.iso /mnt/loop2
# mount -t iso9660 -o ro,noatime,loop session3.iso /mnt/loop3

And voila, all sessions from the cd mounted and ready for analysis! Hopefully someone might find this article of interest.

Sincerely,
Paul Smith