Re: [sleuthkit-users] EXT2 superblock

[Linux T. <lin...@ya...>]

Yes Lisa,

I think perhaps you should purchase oreilly book
understanding linux kernel, or visit their site. 
Sample chapter for download from this book happens to
be ex2/3 filesystem chaper.  Much information
contained there to help you.

To assisst here for you, Superblock for ext2 contain;
# of inodes, FS size in blocks, # reserved blocks,
free block counter, free inode counter, the FS block
size, the FS fragment size, the # blocks/group, the #
of fragments/group, and # inodes/group, time last
mount, time last write, # mount before fschk, status
flag, magic signature, operating system FS was
created, and much more!

You use e2fsck to copy backup superblock to fix your
error.  You use dumpe2fs with 'h' flag to find block
size if you don't know.  1024 BS set at creation is
what you tried, 8193.  But 2048 BS would be 16384 and
standard 4K BS is 32768.  


-lt

--- Lisa Muir <34....@gm...> wrote:

> What information is contained in the ext2
> superblock?
> 
> I have a drive which I can't mount because it has a
> damaged
> superblock, and I'm wondering if I copy the
> superblock off another
> drive with the same partitioning and size, will I be
> able to get
> access to my file.
> 
> All I want to do is get a single dd image file off
> the drive, but I
> can't even mount the drive in Autopsy, says not a
> vald linux
> filesystem.
> 
> If I mount the filesystem as raw, I can't see any
> files.
> 
> Surely there has got to be a way to analyse a disk
> partition if the
> superblock was intentionally damaged?? all that
> other information on
> the disk couldn't be now unreachable?
> 
> Any help / advice much appreciated!
> 
> Lisa.
> 
> 
>
-------------------------------------------------------
> This SF.net email is sponsored by: IT Product Guide
> on ITManagersJournal
> Use IT products in your business? Tell us what you
> think of them. Give us
> Your Opinions, Get Free ThinkGeek Gift Certificates!
> Click to find out more
>
http://productguide.itmanagersjournal.com/guidepromo.tmpl
> _______________________________________________
> sleuthkit-users mailing list
>
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 



		
_______________________________
Do you Yahoo!?
Declare Yourself - Register online to vote today!
http://vote.yahoo.com