Re: [sleuthkit-users] filesystem recovery using sleuthkit

[Brian C. <ca...@sl...>]

On Jan 10, 2005, at 11:24 AM, Jim Cromie wrote:

> Brian Carrier wrote:
>
>>
>> On Jan 9, 2005, at 12:50 PM, Jim Cromie wrote:
>>
>>> Qs:
>>
>
>>> is the choice of filesystem completely dictated by the 
>>> root-directory ?
>>
>>
>> The other way around.  Each file system has its own way of storing 
>> the  contents of a directory and FAT and NTFS are MUCH different.
>>
> poorly stated question.  In your tool, which will work on an image 
> file, there is no
> partition type.  So Im assuming that the code looks for magic bytes in 
> 1st few sectors
> of the image.  Id expect that magic would be part of the root 
> directory.

Nope.  Magic / sigs are all in the boot sector / superblock in the 
first few sectors.  The root directory has the same structure as a 
normal directory.

> So rephrasing;  does your tool have any mechanizm to look for a backup 
> superblock ?
> (they exist in ext2 anyway)

The current version does not.  I am currently adding it to v2.

brian