Re: [sleuthkit-users] Restore a damaged partition

[Eric Y. <er...@mi...>]

Thanks Brian,

>> I run a Feebsd machine. Something happened and the kernel failed to
>> load. I tried restoring but to no avail. I re-installed freebsd and
>> all data from my partitions seemed to have disappeared.

>> Specifically I have one data partition that was not altered at any
>> point, nor during re-install(/web) which I would love to restore...

> What happens when you try to mount it under FreeBSD or Linux?

Well I think that's what I did when I re-installed FreeBSD. The DOS and
FreeBSD partitions did not seem to chgange at all, however after the install
all data was accessible. "/web" was monted on the exact same partition as it
was originally. The partitions did not change.

>>  I installed the Sleuth Kit and Autopsy and was able to view only raw
>> data from the Data Unit option.

> With Autopsy and TSK you will have to identify where the BSD partitions
> are inside of the BSD DOS partition (slice).  If the disk label
> structure inside of the FreeBSD DOS partition was wiped during the
> installation then you will have to figure out where the partition
> actually begins.  The 'gpart' tool may help with this.

I have a feeling that the problem is not finding the partition, though I my
be wrong. I can see the partition. It seems to be in place and of the
correct size.

Eric