Re: [sleuthkit-users] EXT2 superblock

[Linux T. <lin...@ya...>]

--- Brian Carrier <ca...@sl...> wrote:

> Lisa,
> 
> You are confusing the disk master boot record
> (partition table) with 
> the file system superblock.   The MBR is located in
> the first sector of 
> the _disk_.  The superblock is located 1,024 bytes
> from the start of 
> the _partition_.  The first partition typically
> starts in sector 63 of 
> the disk.   So, the below commands changed the
> partition table of your 
> disk.  

But fs info too, yes?  SHe dd 4K.

-lt


If you rebooted, then the OS is going to use
> that partition 
> table for your disk, which may cause the OS to no
> longer associate a 
> device with an actual file system.
> 
> So, at this point a tool like testdisk or gpart will
> be your best 
> friends, but you said that testdisk did not find it.
>  Can you try 
> 'gpart'?
> 
> brian
> 
> 


		
_______________________________
Do you Yahoo!?
Declare Yourself - Register online to vote today!
http://vote.yahoo.com