Re: [sleuthkit-users] Restore a damaged partition

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Apr 4, 2004, at 3:15 AM, Eric Yellin wrote:

> I run a Feebsd machine. Something happened and the kernel failed to=20
> load. I tried restoring but to no avail. I re-installed freebsd and=20
> all data from my partitions seemed to have disappeared.

> Specifically I have one data partition that was not altered at any=20
> point, nor during re-install(/web) which=A0I would love to restore...

What happens when you try to mount it under FreeBSD or Linux?

>  I installed the Sleuth Kit and Autopsy and was able to view only raw=20=

> data from the Data Unit option.

With Autopsy and TSK you will have to identify where the BSD partitions=20=

are inside of the BSD DOS partition (slice).  If the disk label=20
structure inside of the FreeBSD DOS partition was wiped during the=20
installation then you will have to figure out where the partition=20
actually begins.  The 'gpart' tool may help with this.

It would help if you give command examples of what you have done=20
because it gets confusing with the BSD system and the sub-partitions=20
they have inside of the DOS partition.

brian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAcDA/OK1gLsdFTIsRAuRJAJ4+I5Vk2u9nCf2MwIZ6PCjCoUdluwCfZ5/j
FEfaIW0VfhJ/yoKlWUyF6/o=3D
=3DS3Pr
-----END PGP SIGNATURE-----