Re: [sleuthkit-users] Recovering Deleted Partition?

[Brian C. <ca...@sl...>]

> For anyone that may be interested, I've found this tool called 
> "gpart", and a brief description from the pkg-desc in FreeBSD ports 
> gives me:

Yea, this is the tool that I would recommend as well for this function.

> Guessed primary partition table:
> Primary partition(1)
>   type: 007(0x07)(OS/2 HPFS, NTFS, QNX or Advanced UNIX)
>   size: 4886mb #s(10008424) s(63-10008486)
>   chs:  (0/1/1)-(1023/14/63)d (0/1/1)-(10590/14/55)r

This shows that gpart thinks that sectors 63 to 10008486 are for the 
partition.  It is actually fairly easy to figure out the location of 
the first partition because it typically starts in sector 63.  Check 
out the Sleuth Kit Informer #2 if you need help using 'dd' to extract 
the partitions.

http://www.sleuthkit.org/informer/

brian