I'm trying to recover some deleted files from a UFS2 file
system with the sleuthkit. Unfortunatly, most sleuthkit
utilities expect regular image files and won't operate
on block devices:
phenom# fls /dev/ad4s1e
Sector offset supplied is larger than disk image (maximum: 0)
Of course, I could
On Tue, 14 Apr 2009 18:17:24 +0200, cpghost cpgh...@cordula.ws wrote:
I'm trying to recover some deleted files from a UFS2 file
system with the sleuthkit.
:-(
Unfortunatly, most sleuthkit
utilities expect regular image files and won't operate
on block devices:
phenom# fls /dev/ad4s1e
that
it will compress enough to fit, but I was hoping to find a FUSE
daemon or something like that, that would turn a block device
into a regular file (preferably in read-only mode).
In my case, I'm talking about a ca. 80 GB partition which needs
4 hours to be transferred.
Yup, 80 GB are still manageable
On Tue, Apr 14, 2009 at 07:48:16PM +0200, cpghost wrote:
On Tue, Apr 14, 2009 at 07:18:43PM +0200, Polytropon wrote:
On Tue, 14 Apr 2009 18:17:24 +0200, cpghost cpgh...@cordula.ws wrote:
I'm trying to recover some deleted files from a UFS2 file
system with the sleuthkit.
On Tue, Apr 14, 2009 at 09:36:22PM +0200, Roland Smith wrote:
On Tue, Apr 14, 2009 at 07:48:16PM +0200, cpghost wrote:
On Tue, Apr 14, 2009 at 07:18:43PM +0200, Polytropon wrote:
On Tue, 14 Apr 2009 18:17:24 +0200, cpghost cpgh...@cordula.ws wrote:
I'm trying to recover some deleted
