On Fri, 20 Mar 2009 10:05:57 +0800, Fbsd1 <fb...@a1poweruser.com> wrote:
> I have installed these ports
>
> autopsy
> dd_rescue
> ddrescue
> fatback
> formost
> sleuthkit
>
> If my understanding of reading their documentation is correct, they all
> need a empty disk to copy the bad disk sectors to in sequence.
> Is this a correct understanding?
It is. These tools work in a non-destructive way, this means
their (eventually failing) attempts to recover data do not do
any damage to the original (defective) disk. The defective
disk isn't repaired, that would be too dangerous to try.
I would even mention to first make a 1:1 dd copy of the defective
FAT partition and using those tools with the copy, not with the
original.
> msdos fat32 file system has a backup fat table as stated in the docs. Do
> any of the sectors rescue programs read the backup fat table?
dd_rescue - No, does simply copy the partition 1:1.
ddrescue - The same.
sleuthkit - Usually work on a lower level.
formost - Works on a lower level and extracts data files by magic.
autopsy - Offers a "server" for forensic browsing.
fatback - Kind of "undelete tool", no.
The TSK's tools dls, fls and ils don't seem to offer the option
in question.
I read about using alternate superblocks, but that refers to the
UFS file system and not the 2nd FAT. Maybe it's possible to
exactly locate and extract this backup FAT first and then replace
the defective FAT with this copy, using tools like dd?
> Not interested in the XP system or programs directors. Just want user
> data files created by adobe pagemaker. Dont know what the file extension
> is for sure or if there are any way to ID the file from internal
> content. Best guess I have on file extension is .cv5 Do not have a file
> to examen.
The recovery utilities that act by magic aren't interested in the
file name extension. From the manuals of the programs listed above
that mention such a functionality, there's no word about "Adobe
Pagemaker". Would it have been generic files (such as JPG files
for images, TeX / text files for text), or some kind of ODF archive,
it would be much easier.
> What are the general steps I need to do to recover data from this msdos
> FAT32 disk with corrupted fat table and maybe corrupted data?
First, copy the partition:
% ddrescue /dev/ad0s2 fat.dd
I'm not sure how the msdosfs formatted disk / the FAT partition
will show up as device file in FreeBSD. In the result, you can
unplug the disk / remove it and only work with the copy.
Then, you can start extracting data from it, for example with
% mkdir retrieve
% foremost -i fat.dd -v -o retrieve -t all
The manpage of foremost has some examples, too.
The manpage of fatback isn't great, "info fatback" has more
details.
For TSK, use something like this:
% dls -t raw -f fat -v fat.dd
I've got no FAT partitions (defective or intact) at hand so I
cannot check if this really works as I think it should. :-)
--
Polytropon
>From Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
