Hi,
I made a list of forensics packages:
http://www.debian.org/doc/manuals/debian-reference/ch10.en.html#listofpackagesfoforensicanalysis
On Thu, Jan 07, 2010 at 07:30:37PM -0600, John Hasler wrote:
The filesystem on the disk is clearly toast. Mounting it as the wrong
type won't help.
Jochen Schulz wrote:
KS:
I have already started testdisk and it is analysing the disk since the
last hour or so. Should be finished soon.
Good luck!
It might give me an hint as to what is the status of the disk.
No, it coudn't find any partition table after 2 passes.
I started photorec
Hi all,
A friend of mine gave me his hard disk to try to rescue data from it. It
is a 500GB SATA drive which was in an USB enclosure. His machine
(Windows XP) is unable to detect it when the enclosure is connected.
I connected it in my machine (internal SATA) and just did a ddrescue of
the disk
KS:
r...@sysresccd /root % mount -o loop -t iso9660
Why do you mount the dump file from ddrescue as ISO image? Doesn't the
subject say it should actually contain an NTFS filesystem? I am
surprised that this actually works.
/mnt/windows/rescueData.iso /mnt/cdrom
r...@sysresccd /root % ls
KS writes:
I connected it in my machine (internal SATA) and just did a ddrescue
of the disk to a 1.5TB hard disk using a Sysrescue CD. The process
tells me that there were 37 errors totalling 151kB.
Ok...
The ISO image generated is about 466GB.
ISO? I thought you made an image of a NTFS
John Hasler wrote:
KS writes:
I connected it in my machine (internal SATA) and just did a ddrescue
of the disk to a 1.5TB hard disk using a Sysrescue CD. The process
tells me that there were 37 errors totalling 151kB.
Ok...
The ISO image generated is about 466GB.
ISO? I thought you
Jochen Schulz wrote:
KS:
r...@sysresccd /root % mount -o loop -t iso9660
Why do you mount the dump file from ddrescue as ISO image? Doesn't the
subject say it should actually contain an NTFS filesystem? I am
surprised that this actually works.
I tried with ntfs flag too and it doesn't
The filesystem on the disk is clearly toast. Mounting it as the wrong
type won't help. Start looking at forensics packages:
magicrescue - recovers files by looking for magic bytes
myrescue - rescue data from damaged harddisks
scrounge-ntfs - Data recovery program for NTFS filesystems
autopsy -
On Thu, Jan 07, 2010 at 08:12:27PM -0500, KS wrote:
Jochen Schulz wrote:
KS:
r...@sysresccd /root % mount -o loop -t iso9660
Why do you mount the dump file from ddrescue as ISO image? Doesn't the
subject say it should actually contain an NTFS filesystem? I am
surprised that this
Rob Owens wrote:
I think photorec is the right tool for you. It's part of the testdisk
package, which somebody mentioned already. I've used photorec several
times to recover files (all kinds, not just photos) from drives that
were unreadable by other means.
-Rob
I have already
KS:
I have already started testdisk and it is analysing the disk since the
last hour or so. Should be finished soon.
Good luck!
It might give me an hint as to what is the status of the disk.
Install smartmontools and try to run smartctl -a /dev/sdb on it. Then
post the output. It might
11 matches
Mail list logo
