Re: [sleuthkit-users] Funky Partition Table

[Brian C. <ca...@sl...>]

Sector 144585 should have a partition table in it for the extended 
partitions, but it does not seem to (it should end with the typical 
0xAA55 magic value).  Was that one of the errors?

The start of partition "5" should typically be 63 sectors after the 
start of the extended partition (which is 144648).  Check that sector 
to see if there is a file system there.  Do you know how many 
partitions there should be on the system?  If you can find a file 
system in 144648, then see how large the file system is, jump to the 
end of the FS and look for another partition table (or jump ahead 63 
more sectors and look for another file system).

Alternatively, you can use a tool like gpart or testdisk to search for 
the starting locations of the file systems.

brian



On Mar 3, 2005, at 4:49 PM, John T. Hoffoss wrote:

> ---> /usr/local/sleuthkit-1.73/bin/mmls -v -t dos **/images/**.dat
> dos_load_prim: Table Sector: 0
> load_pri:0:0    Start: 63   Size: 32067  Type: 22
> load_pri:0:1    Start: 32130   Size: 112455  Type: 6
> load_pri:0:2    Start: 144585   Size: 16305975  Type: 5
> dos_load_ext: Table Sector: 144585, Primary Base Sector: 144585
> /usr/local/sleuthkit-1.73/bin/mmls: Invalid extended partition table
> in sector 144585
>
> ---> fdisk -lu **/images/**.dat
> Warning: ignoring extra data in partition table 5
> Warning: ignoring extra data in partition table 5
> Warning: invalid flag 0x4fe0 of partition table 5 will be corrected by 
> w(rite)
>
> Disk **/images/**.dat: 9102 MB, 9102397440 bytes
> 255 heads, 63 sectors/track, 1106 cylinders, total 17778120 sectors
> Units = sectors of 1 * 512 = 512 bytes
>
>                Device Boot      Start         End      Blocks   Id  
> System
> **/images/**.dat1              63       32129       16033+  16  Hidden 
> FAT16
> **/images/**.dat2   *       32130      144584       56227+   6  FAT16
> **/images/**.dat3          144585    16450559     8152987+   5  
> Extended
> **/images/**.dat5   ?      212045  2382538316  1191163136   76  Unknown