I am recovering data from hard drives which were part of a damaged
RAID-5 disk array. I used dd to image the drives, and am now
searching these images for files. There are three archives on these
drives which contain all of the relevant data I need to recover.
Using a hex editor, I have opened several known valid bzip2
compressed files in an effort to find common bytes in the files so
that I may identify the bzip2 files on the raw disk images. I see
that the files all begin with the same 10 HEX values - 0x42, 0x5A,
0x68, 0x39, 0x31, 0x41, 0x59, 0x26, 0x53, 0x59. Using this
information, I have identified the address of each of the three files
in the disk images. However, I do not know how to identify the end
of each file. Can you give me any information or suggestion on how I
might find out how long each bzip2 file should be?
The RAID partition was not fragmented. I have been able to extract
word perfect and other files with well known file format markers. I
believe that the physical data on each disk image is intact.
Thanks,
Jim
.===================================.
| This has been a P.L.U.G. mailing. |
| Don't Fear the Penguin. |
| IRC: #utah at irc.freenode.net |
`==================================='
