picking data out of a UFS image
I had an old dying disk and I managed to make a dd image of half of it
before it went completely bellyup. When I have done this in the past I
have been able to use the sleuth kit ffind, fls, etc to dig around, or
even vnconfig and mount the whole image. This time none of that is
working, in fact it claims bad superblock altho I think I found an
alternate that works.
In any case I am able to find some textual data when I simply hexdump
or strings the image, and some of that is what I was looking to
recover. Is it reasonably easy to work backwards from that, say, using
the location I found for the start of this file, to search backwards
and hunt down its inode? Maybe work from there to pick out others?
I guess what I am looking for is a little guidance on picking out UFS
data structures manually. Thanks!
_______________________________________________
freebsd-hackers@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"
討論串 (同標題文章)
完整討論串 (本文為第 2 之 4 篇):