To Ro wrote at 2013-06-14 06:02 -0500: > At this point I have to wait about two weeks before I can afford > getting a 2TB drive where I could dump the recovered parts and try to > resuscitate it. Is there any site that would have information about > forensics? The best way to prepare is by learning the fundamentals, since > anyway I have two weeks of waiting time.
Because I prefer to "learn as I go", I (personally) would in this case immediately start working with the NTFS filesystem. If you *always* mount it read-only, do not feel that a drive failure is imminent, and trust the NTFS drivers, then this should be completely safe. If you can get even a small portion (at the beginning) of the tar.gz, you could (I suppose) use gzcat and then see some of the tar contents on stdout. Perhaps you could even find a way to re-compress it to 4.7GB chunks, and then burn those to DVD or something. Or… <http://qntm.org/transit>
signature.asc
Description: Digital signature
