| View previous topic :: View next topic |
| Author |
Message |
GNUtoo
Veteran
Joined: 05 May 2005
Posts: 1919
|
 Posted: Sat Dec 31, 2005 2:46 pm Post subject: forensics:lost data(anyone experienced it?)[helped][fixed] |
 |
|
i have some old hdd and i want to recover the data
actualy i'm working one one:
description of the data loss
before running linux i was running windows...
and so this hdd ran under windows fir a long time and after a reboot the hdd apeared as blank
description of the work done on it
*dd if=/dev/... of=/... that was a sucess and there is data on the loop file
*i've tryed to mount it using mount -o loop -t ntfs /... /... but it doesn't work
caracteristics:
*ntfs
*mount -o loop -t ntfs /... /... doesn't work
what software i am using
sleuthkit with autopsy frontend
i don't know well how to use this program...
i just want to recover all the files that were on the hdd
the image is not reconised as an ntfs image
Last edited by GNUtoo on Thu Jan 05, 2006 6:06 pm; edited 2 times in total |
|
| Back to top |
|
 |
Tarch
n00b
Joined: 27 Apr 2005
Posts: 42
|
| Posted: Sat Dec 31, 2005 3:04 pm Post subject: |
|
|
Hi, I think it's possible that the problem it's related with a problem on the parition table, googling I found Testdisk I think you can try with this tool. Hope this helps you.
Bye!  |
|
| Back to top |
|
|
GNUtoo
Veteran
Joined: 05 May 2005
Posts: 1919
|
|
| Back to top |
|
|
Tarch
n00b
Joined: 27 Apr 2005
Posts: 42
|
| Posted: Sat Dec 31, 2005 3:16 pm Post subject: |
|
|
I recommend you to try this on the image and to make a backup of it first so you can try other things without loosing the data.
Bye! |
|
| Back to top |
|
|
GNUtoo
Veteran
Joined: 05 May 2005
Posts: 1919
|
| Posted: Sat Dec 31, 2005 4:49 pm Post subject: |
|
|
status:
*was compiling...pentium 3 500MHz
*stoped for hdd space issues...making some space
so mabe:
*i restore my partition
*i will try to read it with autopsy+sleuthkit |
|
| Back to top |
|
|
Tarch
n00b
Joined: 27 Apr 2005
Posts: 42
|
| Posted: Sun Jan 01, 2006 10:42 am Post subject: |
|
|
So testdisk had worked?
Bye! |
|
| Back to top |
|
|
GNUtoo
Veteran
Joined: 05 May 2005
Posts: 1919
|
| Posted: Thu Jan 05, 2006 5:56 pm Post subject: |
|
|
great!!!!!!!!!!!!
i havve my partition reconised
now i'm rebooting...
WORKED
thank a lot!!!!!!!!!!!
by the way i'll bugreport that it works only with my ide hdd and not the ones that are on my highpoint ide raid card(non raid hdd,actualy used because i have too much hdds(too long to explain)) |
|
| Back to top |
|
|
Tarch
n00b
Joined: 27 Apr 2005
Posts: 42
|
| Posted: Sat Jan 07, 2006 8:47 am Post subject: |
|
|
I'm very happy for you!
Bye! |
|
| Back to top |
|
|
|
Other Things Gentoo
