Re: [sleuthkit-users] EXT2 superblock

[Brian C. <ca...@sl...>]

On Oct 3, 2004, at 5:44 AM, Lisa Muir wrote:

> What information is contained in the ext2 superblock?

There is a lot of size and layout information in there.

> I have a drive which I can't mount because it has a damaged
> superblock, and I'm wondering if I copy the superblock off another
> drive with the same partitioning and size, will I be able to get
> access to my file.
>
> All I want to do is get a single dd image file off the drive, but I
> can't even mount the drive in Autopsy, says not a vald linux
> filesystem.

You are using the file system image and not the disk image right? 
Autopsy needs the file system image (i.e. hda1) and checks only that 
the magic value is there, so I would first check that you are using the 
actual file system image.  Otherwise, you can try and copy a superblock 
from another system.  There are also many backup copies of the 
superblock in the file system, which is not always easy to restore.

brian