On Tue, Apr 14, 2009 at 07:48:16PM +0200, cpghost wrote: > On Tue, Apr 14, 2009 at 07:18:43PM +0200, Polytropon wrote: > > On Tue, 14 Apr 2009 18:17:24 +0200, cpghost <cpgh...@cordula.ws> wrote: > > > I'm trying to recover some deleted files from a UFS2 file > > > system with the sleuthkit. > > > > > Unfortunatly, most sleuthkit > > > utilities expect regular image files and won't operate > > > on block devices:
For the record, FreeBSD doesn't have block devices. They are all character devices. Compare the output of "ls -l /dev | grep '^b'" with that of ls -l /dev | grep '^c'. Might this be what is bugging sleuthkit? > phenom# mdconfig -a -t vnode -o readonly -f /dev/ad4s1e > mdconfig: ioctl(/dev/mdctl): Invalid argument The vnode type md can only use regular files. See md(4). > > > but unfortunatly, the file system I'm trying to analyze > > > is VERY large and I don't have enough disk space elsewhere > > > to take an image. Well, fls and other sleuthkit programs support split images. Will it fit if you divide it into several smaller files? > > I would strongly advice you *not* to experiment with the original > > disk, because this *may* lead you to more problems. very good advice IMHO. > But that's not the issue here. The file system itself is over 470GB > (it occuples the whole 500GB disk), and while I do have spare 500GB > disks, the whole image won't fit into a filesystem: it will be slightly > too big. Maybe it will fit if you play with the newfs parameters of the new disk? Shrinking the reserved space, enlarging the block and fragment size and reducing the number of inodes, that kind of thing. Roland -- R.F.Smith http://www.xs4all.nl/~rsmith/ [plain text _non-HTML_ PGP/GnuPG encrypted/signed email much appreciated] pgp: 1A2B 477F 9970 BA3C 2914 B7CE 1277 EFB0 C321 A725 (KeyID: C321A725)
pgpoZBSyxmqHH.pgp
Description: PGP signature
