Hi,
I made a list of forensics packages:
http://www.debian.org/doc/manuals/debian-reference/ch10.en.html#listofpackagesfoforensicanalysis
On Thu, Jan 07, 2010 at 07:30:37PM -0600, John Hasler wrote:
> The filesystem on the disk is clearly toast. Mounting it as the wrong
> type won't help. Sta
Jochen Schulz wrote:
> KS:
>>
>> I have already started testdisk and it is analysing the disk since the
>> last hour or so. Should be finished soon.
>
> Good luck!
>
>> It might give me an hint as to what is the status of the disk.
No, it coudn't find any partition table after 2 passes.
I start
KS:
>
>
> I have already started testdisk and it is analysing the disk since the
> last hour or so. Should be finished soon.
Good luck!
> It might give me an hint as to what is the status of the disk.
Install smartmontools and try to run smartctl -a /dev/sdb on it. Then
post the output. It mig
Rob Owens wrote:
>
> I think photorec is the right tool for you. It's part of the testdisk
> package, which somebody mentioned already. I've used photorec several
> times to recover files (all kinds, not just photos) from drives that
> were unreadable by other means.
>
> -Rob
>
>
I have alrea
On Thu, Jan 07, 2010 at 08:12:27PM -0500, KS wrote:
> Jochen Schulz wrote:
> > KS:
> >> r...@sysresccd /root % mount -o loop -t iso9660
> >
> > Why do you mount the dump file from ddrescue as ISO image? Doesn't the
> > subject say it should actually contain an NTFS filesystem? I am
> > surprised t
The filesystem on the disk is clearly toast. Mounting it as the wrong
type won't help. Start looking at forensics packages:
magicrescue - recovers files by looking for magic bytes
myrescue - rescue data from damaged harddisks
scrounge-ntfs - Data recovery program for NTFS filesystems
autopsy - g
Jochen Schulz wrote:
> KS:
>> r...@sysresccd /root % mount -o loop -t iso9660
>
> Why do you mount the dump file from ddrescue as ISO image? Doesn't the
> subject say it should actually contain an NTFS filesystem? I am
> surprised that this actually works.
I tried with ntfs flag too and it doesn'
John Hasler wrote:
> KS writes:
>> I connected it in my machine (internal SATA) and just did a ddrescue
>> of the disk to a 1.5TB hard disk using a Sysrescue CD. The process
>> tells me that there were 37 errors totalling 151kB.
>
> Ok...
>
>> The ISO image generated is about 466GB.
>
> "ISO"?
KS writes:
> I connected it in my machine (internal SATA) and just did a ddrescue
> of the disk to a 1.5TB hard disk using a Sysrescue CD. The process
> tells me that there were 37 errors totalling 151kB.
Ok...
> The ISO image generated is about 466GB.
"ISO"? I thought you made an image of a NT
KS:
>
> r...@sysresccd /root % mount -o loop -t iso9660
Why do you mount the dump file from ddrescue as ISO image? Doesn't the
subject say it should actually contain an NTFS filesystem? I am
surprised that this actually works.
> /mnt/windows/rescueData.iso /mnt/cdrom
> r...@sysresccd /root % ls
Hi all,
A friend of mine gave me his hard disk to try to rescue data from it. It
is a 500GB SATA drive which was in an USB enclosure. His machine
(Windows XP) is unable to detect it when the enclosure is connected.
I connected it in my machine (internal SATA) and just did a ddrescue of
the disk t
11 matches
Mail list logo
