Re: [sleuthkit-users] EXT2 superblock

[Brian C. <ca...@sl...>]

On Oct 3, 2004, at 8:05 PM, Linux Tard wrote:
>>
> But fs info too, yes?  SHe dd 4K.
>

No, because the first partition is not typically until sector 63, which 
is ~32K into the disk.  Sectors 1 to 62 may contain boot code and the 
system will no longer boot, but the FS data should be fine.  Superblock 
is two more sectors into the partition and the group descriptors are a 
few more KB in after that (depending on the FS block size).

So, Lisa's file system should still be intact, the issue is finding out 
where it starts and ends.

brian