Another long weekend

This weekend I have another project for school due. In it, I must analyze Linux image created using dd. I'll be looking at the image using sleuthkit primarily as well as mounting the image as a read only file system. I need to be able to determine what happened an when. From a cursory glance, it looks like I might be having to recovery deleted files as well. Oh joy.

Right now I'm having some problems with the mounted image. I'm trying to copy a couple files off and I'm not able to do it. I need the password and group files to make mactime display the actual user and group names instead of numbers. Hopefully when I do that I can construct some sort of timeline of activity.