Re: [sleuthkit-users] Lost a folder on my hard drive somehow can I recover?
Brought to you by:
carrier
Menu
▾
▴
Re: [sleuthkit-users] Lost a folder on my hard drive somehow can I recover?
|
From: Kaya S. <Sam...@ne...> - 2010-05-07 17:47:04
|
Thanks for the reply Joseph! :-) It's much appreciated..... Just to quote: "On a separate note, don't be surprised if a mailing list doesn't help you retrieve your pirated media collection. Just saying." I would have to debate this as most of the stuff I have is recorded from the TV not ripped from dvd. I know this is a separate debate but in my view this falls under non-pirated media as it's similar to recording on VHS, DVD, or BlueRay directly from the set top box. Anyhow I don't want to get into a discussion about this as it always ends up in a fight and I am not trying to make enemies but the exact reciprocal :-) How do I create images?? Using dd tool?? Meaning that I need about a 250GB+ HD to store the image on and work from it. Something like this: dd if=/dev/sdc bs=4096 of=usb4gb.dd which was for a USB drive..... Regards, Kaya On 05/07/2010 08:34 PM, Joseph R. Murray wrote: > You can try using testdisk, but you might want to grab a full disk > image backup before trying it. It helped me out in a similar situation. > > http://www.cgsecurity.org/wiki/TestDisk > > On a separate note, don't be surprised if a mailing list doesn't help > you retrieve your pirated media collection. Just saying. > > On Fri, May 7, 2010 at 6:04 AM, Kaya Saman <Sam...@ne... > <mailto:Sam...@ne...>> wrote: > > Hi guys, > > just wanted to bump my posting as no one responded! > > I hope it's not because because the overall thought is that I > failed to research or simply "ha ha ha ha ha get a life".... > > I am merely asking for advice or knowledge from experienced > members just to ensure that it's worth me spending the time and > effort to go ahead with this; so that if it was a lost cause I > could look at checking the integrity of the data already there or > reformatting the drive and starting clean. > > Many thanks, > > Kaya > > > > > On 05/04/2010 05:12 PM, Kaya Saman wrote: >> Hi, >> >> I've got an external eSATA 200GB hard drive formatted to ext3 of >> which I was using till now via USB2.0 connection. >> >> I recently hooked the drive up to my FreeBSD 8.0 32bit based >> server in ReadOnly mode upon mount in order to stream the >> information across my network so that I wouldn't have cables >> flying around the place. >> >> Anyhow, yesterday I attached the hard drive and started watching >> my downloaded TV show. I noticed something went out of whack >> after I clicked incremental files and the video shown was not >> linear. - What I'm trying to say is that the file name didn't >> match the file played back!! >> >> This originally was fine but somehow got messed up. >> >> Anyhow, I unmounted the drive and ran e2fsck -p on it which the >> check claimed the disk was 'clean'. >> >> I mounted the drive again and the folder has totally disappeared >> now and instead shows a file: >> >> -rw-r--r-- 1 kaya kaya 2046682574 2009-09-13 07:06 >> Battlestar.Galactica.Season.1.720p.x264 >> >> Using the df command it shows that the usage is back to normal as >> it managed to drop down to 50% yesterday: >> >> /dev/sdb1 184G 137G 38G 79% /mnt/eSATAI >> >> I haven't written or deleted anything to the drive at all since >> the error..... >> >> >> It could be that the FreeBSD ext2fs did something although I made >> sure the drive was in ReadOnly mode or it could be the fact that >> I was using the USB2.0 interface which I've always found to be >> dodgy when used in conjunction with the ext3 file system. >> >> The files are all mkv format and the average size is roughly 4.8GB. >> >> I tried using GPart, Foremost, and MagicRescue but eventually >> fell short each time although I think Foremost detects the files >> but in the wrong format as WMV. >> >> Can anyone help me recover what ever has happened to this drive??? >> >> The Sleuth Kit is install along with Autopsy, and I attempted to >> use it but fell into a trap on the add disk image section. Do I >> need to create an image or can I work from the raw drive? >> >> I am pretty sure the data is still there and rescueable as the >> drive is pretty new, less then a year old I believe. >> >> Many thanks and best regards, >> >> Kaya >> >> >> ------------------------------------------------------------------------------ >> >> >> >> _______________________________________________ >> sleuthkit-users mailing list >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users >> http://www.sleuthkit.org >> > > > ------------------------------------------------------------------------------ > > > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org > > |
