Re: [sleuthkit-users] filesystem recovery using sleuthkit

[Linux T. <lin...@ya...>]

--- Brian Carrier <ca...@sl...> wrote:
> Nope.  Magic / sigs are all in the boot sector /
> superblock in the 
> first few sectors.  The root directory has the same
> structure as a 
> normal directory.
> 

QUESTION - what is the magic signature for FAT12/16/32
and NTFS?  I can't find it.  So I guess I'm asking
what and where do you look Brian?


BACKUP SUPERBLOCK - use 'findsuper' to locate back up
superblock.  Works good for ext2/3 fs.


-lt



		
__________________________________ 
Do you Yahoo!? 
Yahoo! Mail - now with 250MB free storage. Learn more.
http://info.mail.yahoo.com/mail_250