Re: [sleuthkit-users] EXT2 superblock

[Lisa M. <34....@gm...>]

Brian/LT, 

With LT's kind assistance and guidance, I was able to get access to
the filesystem. I used the following process:

# mk2fs -S /dev/hdb

which wrote just the superblock. 

I ran e2fsck and after it had completed I was able to mount the
filesystem and browse the filesystem. All files appeared to be there
and appeared to be the correct size.

#fdisk -lu disk.dd 

gave the error that there was no valid partition table. 

Also, when I did an md5sum on the image file, the md5 didn't match the
original md5 of the drive that was imaged. So somewhere the file was
altered.

Now, in my case, I'm not sure if the process modified the file, or my
screwing around with the entire thing modified the file..as I plodded
through a few different things before going down this last
path.....however, I'm going to replicate this secnario with two
smaller drives, to see if it happens again.

My thinking for a test is to format a drive, write 1k to the
superblock. Make sure it's screwed and can't mount, the run the two
commands again and see what occurs in a controlled manner.

Thankfully, this was an unneeded file, and simply an experiment but it
was a great learning experience. Thank you Brian and LT for your
patience.


On Mon, 4 Oct 2004 21:35:27 -0700 (PDT), Linux Tard <lin...@ya...> wrote:
> 
> 
> --- Lisa Muir <34....@gm...> wrote:
> 
> > Here is the output of gpart:
> >
> >
> > Begin scan...
> > Possible partition(DOS FAT), size(10mb),
> > offset(338mb)
> > End scan.
> >
> > Checking partitions...
> > Partition(Primary DOS with 12 bit FAT): primary
> > Ok.
> >
> > Guessed primary partition table:
> > Primary partition(1)
> >    type: 001(0x01)(Primary DOS with 12 bit FAT)
> >    size: 10mb #s(20739) s(693126-713864)
> >    chs:  (43/37/1)-(44/111/12)d
> > (43/37/1)-(44/111/12)r
> >
> > Primary partition(2)
> >    type: 000(0x00)(unused)
> >    size: 0mb #s(0) s(0-0)
> >    chs:  (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r
> >
> > Primary partition(3)
> >    type: 000(0x00)(unused)
> >    size: 0mb #s(0) s(0-0)
> >    chs:  (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r
> >
> > Primary partition(4)
> >    type: 000(0x00)(unused)
> >    size: 0mb #s(0) s(0-0)
> >    chs:  (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r
> >
> > Which is incorrect, since I know it was definitely
> > an ext2 partition.
> >
> > I didn't have too much time to play with it
> > today.....
> >
> > Lisa-
> >
> 
> yes Lisa, but because you dd from another device with
> different partition.  gpart reads that info.
> 
> -lt
> 
> 
> __________________________________
> Do you Yahoo!?
> Yahoo! Mail is new and improved - Check it out!
> 
> 
> http://promotions.yahoo.com/new_mail
>