[sleuthkit-users] Re: sleuthkit-users digest, Vol 1 #293 - 5 msgs

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

        The floppy is not physically damaged. It shows me the
following error when mounting the floppy :

mount /mnt/floppy/
/dev/fd0: Input/output error
mount: you must specify the filesystem type

       =20
       enda : Thanks for ur help. I am new to linux and i dont know
most of the commands.
So pls give me the complete command for the following suggestion u gave me

            when dd'ing a floppy, try using bs=3D1 and conv=3Dnoerror,
then mounting the
            image under loopback.

First of all, I am not able to mount the floppy. I am getting the above err=
or.

pradeep

On 4/26/05, sle...@li...
<sle...@li...> wrote:
> Send sleuthkit-users mailing list submissions to
> =09s...@li...
>=20
> To subscribe or unsubscribe via the World Wide Web, visit
> =09https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> or, via email, send a message with subject or body 'help' to
> =09s...@li...
>=20
> You can reach the person managing the list at
> =09s...@li...
>=20
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of sleuthkit-users digest..."
>=20
>=20
> Today's Topics:
>=20
>    1. Corrupted floppy (Pradeep M)
>    2. Re: Corrupted floppy (Brian Carrier)
>    3. Re: Corrupted floppy (Enda Cronnolly)
>    4. ISTAT output question (Jaime Chang)
>    5. Re: ISTAT output question (Brian Carrier)
>=20
> --__--__--
>=20
> Message: 1
> Date: Mon, 25 Apr 2005 15:45:07 +0530
> From: Pradeep M <pra...@gm...>
> Reply-To: Pradeep M <pra...@gm...>
> To: sle...@li...
> Subject: [sleuthkit-users] Corrupted floppy
>=20
> Hi=3D20
>         Is it possible to recover data from  a corrupted floppy using
> sleuthkit and autopsy.
> I tried using the tool but first of all its not possible to mount the
> floppy itself. I want to know whether it is possible to recover data
> from a corrupted floppy using this tool and if its not possible then
> which tool should be used. Pls help.
>=20
> Pradeep
>=20
>=20
> --__--__--
>=20
> Message: 2
> Cc: sle...@li...
> From: Brian Carrier <ca...@sl...>
> Subject: Re: [sleuthkit-users] Corrupted floppy
> Date: Mon, 25 Apr 2005 09:18:27 -0500
> To: Pradeep M <pra...@gm...>
>=20
> How do you mean "corrupted"?  Is the file system corrupt or is the=20
> physical media damaged and it generates errors when you try to read it?=
=20
>   If it is physical damage, then TSK / Autopsy will not help.  If it is=
=20
> file system corruption, then you can try them but they will not fix any=
=20
> errors that exist.  You can also make  an image of the floppy using=20
> 'dd' and then run fsck on a copy so that it fixes any errors.
>=20
> brian
>=20
>=20
>=20
> On Apr 25, 2005, at 5:15 AM, Pradeep M wrote:
>=20
> > Hi
> >         Is it possible to recover data from  a corrupted floppy using
> > sleuthkit and autopsy.
> > I tried using the tool but first of all its not possible to mount the
> > floppy itself. I want to know whether it is possible to recover data
> > from a corrupted floppy using this tool and if its not possible then
> > which tool should be used. Pls help.
> >
>=20
>=20
>=20
> --__--__--
>=20
> Message: 3
> From: "Enda Cronnolly" <en...@co...>
> To: <sle...@li...>
> Subject: Re: [sleuthkit-users] Corrupted floppy
> Date: Mon, 25 Apr 2005 17:32:45 +0100
>=20
> when dd'ing a floppy, try using bs=3D1 and conv=3Dnoerror, then mounting =
the
> image under loopback.
>=20
> Have had sucess recovering some files which suffered the "thesis field
> effect" that way where there was physical damage to the disk. Document
> probably won't be 100% intact, but the majority of the content was
> recoverable.
>=20
> HTH,
>=20
>  -Enda.
>=20
> ----- Original Message -----=20
> From: "Brian Carrier" <ca...@sl...>
> To: "Pradeep M" <pra...@gm...>
> Cc: <sle...@li...>
> Sent: Monday, April 25, 2005 3:18 PM
> Subject: Re: [sleuthkit-users] Corrupted floppy
>=20
>=20
> > How do you mean "corrupted"?  Is the file system corrupt or is the
> > physical media damaged and it generates errors when you try to read it?
> >   If it is physical damage, then TSK / Autopsy will not help.  If it is
> > file system corruption, then you can try them but they will not fix any
> > errors that exist.  You can also make  an image of the floppy using
> > 'dd' and then run fsck on a copy so that it fixes any errors.
> >
> > brian
> >
> >
> >
> > On Apr 25, 2005, at 5:15 AM, Pradeep M wrote:
> >
> > > Hi
> > >         Is it possible to recover data from  a corrupted floppy using
> > > sleuthkit and autopsy.
> > > I tried using the tool but first of all its not possible to mount the
> > > floppy itself. I want to know whether it is possible to recover data
> > > from a corrupted floppy using this tool and if its not possible then
> > > which tool should be used. Pls help.
> > >
> >
> >
> >
> > -------------------------------------------------------
> > SF email is sponsored by - The IT Product Guide
> > Read honest & candid reviews on hundreds of IT Products from real users=
.
> > Discover which products truly live up to the hype. Start reading now.
> > http://ads.osdn.com/?ad_id=3D6595&alloc_id=3D14396&op=3Dclick
> > _______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
> >
>=20
>=20
>=20
> --__--__--
>=20
> Message: 4
> Date: Mon, 25 Apr 2005 16:30:32 -0400
> From: Jaime Chang <jc...@id...>
> Organization: I.D.E.A.L. Technology Corporation
> To: sle...@li...
> Subject: [sleuthkit-users] ISTAT output question
>=20
> Hello everybody,
>=20
> In the following istat output,
>=20
> Directory Entry: 24006
> Not Allocated
> File Attributes: File, Archive
> Size: 10425
> Num of links: 0
> Name: _UTFOXED.PNG
>=20
> Directory Entry Times:
> Written:        Sun Feb 27 14:39:58 2005
> Accessed:       Sun Feb 27 00:00:00 2005
> Created:        Sun Feb 27 14:39:58 2005
>=20
> Sectors:
> 1545 1546 1547 1548
>=20
> Recovery:
> 1545 1546 1547 1548 1549 1550 1551 1552
> 1553 1554 1555 1556 1557 1558 1559 1560
> 1561 1562 1563 1564 1565 1566 1567 1568
>=20
> Does anyone know what might be the difference, if any, between the=20
> sectors in the "Sectors:" section and the sectors in the "Recovery:"=20
> section. In most of the deleted files I have been trying, the sectors=20
> from the "Sectors:" section is always included in the "Recovery:"=20
> section. Is there a case where this might not be true?
>=20
> Thanks in advance
>=20
> Jimmy.
>=20
>=20
>=20
> --__--__--
>=20
> Message: 5
> Cc: sle...@li...
> From: Brian Carrier <ca...@sl...>
> Subject: Re: [sleuthkit-users] ISTAT output question
> Date: Mon, 25 Apr 2005 16:53:22 -0500
> To: Jaime Chang <jc...@id...>
>=20
>=20
> On Apr 25, 2005, at 3:30 PM, Jaime Chang wrote:
>=20
> > Hello everybody,
> >
> > In the following istat output,
>=20
> [...]
>=20
> > Sectors:
> > 1545 1546 1547 1548
> >
> > Recovery:
> > 1545 1546 1547 1548 1549 1550 1551 1552
> > 1553 1554 1555 1556 1557 1558 1559 1560
> > 1561 1562 1563 1564 1565 1566 1567 1568
> >
> > Does anyone know what might be the difference, if any, between the=20
> > sectors in the "Sectors:" section and the sectors in the "Recovery:"=20
> > section. In most of the deleted files I have been trying, the sectors=
=20
> > from the "Sectors:" section is always included in the "Recovery:"=20
> > section. Is there a case where this might not be true?
>=20
> The sectors in the "Sectors:" section are the ones in the starting=20
> cluster of the file.   Because  the file is unallocated and we know=20
> only the starting cluster (sectors), TSK tries to determine the=20
> remaining sectors.  Those are listed in the recovery section.  So, yes=20
> the "Recovery" section will always contain the sectors from the=20
> "Sectors" section.  They are separated to show which addresses we have=20
> more confidence in.  We know the 1545-1548 addresses are correct for=20
> the file because they are referenced by the directory entry, but the=20
> other addresses could be incorrect if the original file was fragmented=20
> and TSK couldn't determine the original layout.
>=20
> brian
>=20
>=20
>=20
>=20
> --__--__--
>=20
> _______________________________________________
> sleuthkit-users mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>=20
>=20
> End of sleuthkit-users Digest
>