[sleuthkit-users] Recovering Deleted Partition?

[Matt C. <mat...@ho...>]

Hello list!

I've used the Sleuthkit with Autopsy quite successfully for the Challenges 
from HoneyNet, and I decided to kick it up a notch.

I asked a friend to use an old 5GB hard drive, and just write a bunch of 
stuff to the disk, and record what files he'd like to have recovered (this 
is just for practice, BTW). Anyway, he ended up formatting and deleting the 
partition on the disk. (FAT32 partition).

I made an image of the disk, and tried importing it into autopsy. Whoops. 
Aparently it doesn't like images of whole disks. No problemo, I'll follow 
the "split" document I saw. Oh... I have no partitions available... hmmm

How would I go about recovering these partitions? I remember seeing a tool 
for this donkey's years ago, but it was in DOS, and that was on a proper 
disk. I'm working with an image in FreeBSD. I haven't been able to find any 
tools to recover the partition tables. :(

Does anyone have any recommendations, or know of a way to recover then in 
sleuth?

Thanks!
MM

_________________________________________________________________
Add photos to your messages with MSN 8. Get 2 months FREE*.  
http://join.msn.com/?page=dept/features&pgmarket=en-ca&RU=http%3a%2f%2fjoin.msn.com%2f%3fpage%3dmisc%2fspecialoffers%26pgmarket%3den-ca