On Wed, Feb 25, 2009 at 1:47 PM, Daniel Johnson <[email protected]> wrote:
> > Gah I knew I was being dyslexic. Again thank you for the info.
>
> Okay this is tested, and works to find the byte offsets of perl files.
> Don't have a good extractor to go with it.
>
> #!/usr/bin/perl
>
> my $partition;
> open($partition,'<','/dev/sdb2') or die("could not open file\n");
>
> seek($partition,0,0);
> print "starting at position:", tell($partition), "\n";
> for(my $block=0;seek($partition,1024 * $block,0);$block++)
> {
> my $pos = tell($partition);
> #print STDERR "\rcurrent block:", $block;
> my $line;
> read($partition,$line,20);
> if($line =~ qr{^#! */usr/bin/perl})
> {
> #print STDERR "\n";
> print "$pos\n";
> #print STDERR "\n";
> }
> }
> #print "\n";
> _______________________________________________
>
Thanks Daniel! I'll give it a spin and see what happens. As Hal mentioned
earlier the image I created might have been corrupted (which it turns out it
was) I was able to fix it with e2fsck, which may have done more damage in
terms of getting my data back but we'll see. I did manage, using sleuthkit
and foremost to grab some data albeit with some issues in the files but the
recovered data was useable enough to restore some of the missing data.
Glad I'm learning the lessons and techniques now on non-mission critical
data instead of something really blowing up and causing issues for me. I'd
really like to invest in a Netapp Filer to go along with this server but the
drive capacities available are pretty small for the heads that I can find on
ebay that are cheap enough for me to afford right now given that I'm not
working. The machine I have is physically located in the Infinity Internet
Data Center in Downtown, not a home machine where I can attach some non-rack
mountable SAN/NAS device.
_______________________________________________
PLUG mailing list
[email protected]
http://lists.pdxlinux.org/mailman/listinfo/plug
