picking data out of a UFS image

看板FB_hackers作者時間11年前 (2014/06/14 02:01), 編輯推噓0(000)
留言0則, 0人參與, 最新討論串2/4 (看更多)
I had an old dying disk and I managed to make a dd image of half of it before it went completely bellyup. When I have done this in the past I have been able to use the sleuth kit ffind, fls, etc to dig around, or even vnconfig and mount the whole image. This time none of that is working, in fact it claims bad superblock altho I think I found an alternate that works. In any case I am able to find some textual data when I simply hexdump or strings the image, and some of that is what I was looking to recover. Is it reasonably easy to work backwards from that, say, using the location I found for the start of this file, to search backwards and hunt down its inode? Maybe work from there to pick out others? I guess what I am looking for is a little guidance on picking out UFS data structures manually. Thanks! _______________________________________________ freebsd-hackers@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-hackers To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"
文章代碼(AID): #1JcpnVWh (FB_hackers)
文章代碼(AID): #1JcpnVWh (FB_hackers)