08Oct2004 (UTC +8)
Paolo Alexis Falcone wrote: ...
Any hints as to how I could find where the partition started and ended? When I tried `cat /dev/hda6` I could still see the filenames along with the binary content. I'm not sure if I made a mistake with finding the sizes of the rest of the partitions which might be the reason why I can't find where /dev/hda6 started (and the next problem would be finding where the filesystem superblock resided inside /dev/hda6).
Paolo Alexis Falcone [EMAIL PROTECTED]
Dude, try: 1. dd if=/dev/hda of=/mnt/knoppixed/hda.img =back-up the whole hdd so if you mess something up, it won't be a disaster 2. mmls -t dos hda.img =from http://www.sleuthkit.org/sleuthkit/man/mmls.html =will show start and end of sectors per partition =good to know so you can use dd to just slice off the partition you want to recover 3. dd if=hda.img bs=512 skip=63 count=123456 of=hda6.img =63 is just a sample number where a partition begins, while 123456 is also another sample number about size of partition 4. mount -o,loop hda6.img /mnt/recovered
Hope this helps... I'm typing as accurately as I could but with my bandaged right wrist it's a bit difficult :) Sorry for any typo's...
Drexx Laggui Principal Consultant, Information Security http://www.laggui.com
-- Philippine Linux Users' Group (PLUG) Mailing List [EMAIL PROTECTED] (#PLUG @ irc.free.net.ph) Official Website: http://plug.linux.org.ph Searchable Archives: http://marc.free.net.ph . To leave, go to http://lists.q-linux.com/mailman/listinfo/plug . Are you a Linux newbie? To join the newbie list, go to http://lists.q-linux.com/mailman/listinfo/ph-linux-newbie
