[sleuthkit-users] Recovering Deleted Partition?

[Matt C. <mat...@ho...>]

Note to self: investigate more before begigng for help...

For anyone that may be interested, I've found this tool called "gpart", and 
a brief description from the pkg-desc in FreeBSD ports gives me:

Port:   gpart-0.1h
Path:   /usr/ports/sysutils/gpart
Info:   Tries to recover lost partition tables and file systems

*sigh* anyway, it gave me the following information about my disk image:

Begin scan...
Possible partition(Windows NT/W2K FS), size(4886mb), offset(0mb)

* Warning: short read near sector(10018701), 64512 bytes instead of 66048. 
Skipping...
End scan.

Checking partitions...
Partition(OS/2 HPFS, NTFS, QNX or Advanced UNIX): primary
Ok.

Guessed primary partition table:
Primary partition(1)
   type: 007(0x07)(OS/2 HPFS, NTFS, QNX or Advanced UNIX)
   size: 4886mb #s(10008424) s(63-10008486)
   chs:  (0/1/1)-(1023/14/63)d (0/1/1)-(10590/14/55)r

Primary partition(2)
   type: 000(0x00)(unused)
   size: 0mb #s(0) s(0-0)
   chs:  (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

Primary partition(3)
   type: 000(0x00)(unused)
   size: 0mb #s(0) s(0-0)
   chs:  (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

Primary partition(4)
   type: 000(0x00)(unused)
   size: 0mb #s(0) s(0-0)
   chs:  (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r


Hopefully that will get me somewhere. :)

_________________________________________________________________
MSN 8 with e-mail virus protection service: 2 months FREE*  
http://join.msn.com/?page=features/virus&pgmarket=en-ca&RU=http%3a%2f%2fjoin.msn.com%2f%3fpage%3dmisc%2fspecialoffers%26pgmarket%3den-ca