Re: [sleuthkit-users] Corrupted floppy

[Enda C. <en...@co...>]

I find that when accessing a damaged floppy from windows / linux through an
application, when it can't read to EOF it refuses to display what it can
read resulting in you not being able to retrieve any data. Even without the
padded zero's, you will be able to read a corrupted file from the image
through to EOF, and it will display all that is available despite the file
integrity. Typically you loose a lot of formatting etc, and have to fish out
the relevant info. Strings is very useful for that.

 -Enda.

----- Original Message ----- 
From: "Bradley B" <br...@de...>
To: "'Enda Cronnolly'" <en...@co...>
Cc: <sle...@li...>
Sent: Sunday, May 01, 2005 1:33 AM
Subject: RE: [sleuthkit-users] Corrupted floppy


> When using conv=noerror it will begin writing to the file when it can read
> more data, which will prevent offsets from being correct. A solution is
> conv=sync,noerror where it will write zeroes when it has an error reading
> the disk. I find using sleuthkit and autopsy to recover files on a damaged
> filesystem is more successful than using the operating system and trying
to
> access the data.
>
> -----Original Message-----
> From: sle...@li...
> [mailto:sle...@li...] On Behalf Of Enda
> Cronnolly
> Sent: Monday, April 25, 2005 12:33 PM
> To: sle...@li...
> Subject: Re: [sleuthkit-users] Corrupted floppy
>
>
> when dd'ing a floppy, try using bs=1 and conv=noerror, then mounting the
> image under loopback.
>
> Have had sucess recovering some files which suffered the "thesis field
> effect" that way where there was physical damage to the disk. Document
> probably won't be 100% intact, but the majority of the content was
> recoverable.
>
> HTH,
>
>  -Enda.
>
> ----- Original Message ----- 
> From: "Brian Carrier" <ca...@sl...>
> To: "Pradeep M" <pra...@gm...>
> Cc: <sle...@li...>
> Sent: Monday, April 25, 2005 3:18 PM
> Subject: Re: [sleuthkit-users] Corrupted floppy
>
>
> > How do you mean "corrupted"?  Is the file system corrupt or is the
> > physical media damaged and it generates errors when you try to read it?
> >   If it is physical damage, then TSK / Autopsy will not help.  If it is
> > file system corruption, then you can try them but they will not fix any
> > errors that exist.  You can also make  an image of the floppy using
> > 'dd' and then run fsck on a copy so that it fixes any errors.
> >
> > brian
> >
> >
> >
> > On Apr 25, 2005, at 5:15 AM, Pradeep M wrote:
> >
> > > Hi
> > >         Is it possible to recover data from  a corrupted floppy using
> > > sleuthkit and autopsy.
> > > I tried using the tool but first of all its not possible to mount the
> > > floppy itself. I want to know whether it is possible to recover data
> > > from a corrupted floppy using this tool and if its not possible then
> > > which tool should be used. Pls help.
> > >
> >
> >
> >
> > -------------------------------------------------------
> > SF email is sponsored by - The IT Product Guide
> > Read honest & candid reviews on hundreds of IT Products from real users.
> > Discover which products truly live up to the hype. Start reading now.
> > http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> > _______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
> >
>
>
>
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>