Re: [sleuthkit-users] Was FAT32, now NTFS

[Brian C. <ca...@sl...>]

On Jul 26, 2005, at 5:26 PM, Mark K. Murdock wrote:

> Hi all,
>
> I have a drive that was previously a FAT32 drive on a Windows ME=20
> system.=A0 The drive was recently formatted as NTFS in Windows XP (and=20=

> *very* little activity has occurred on it since then).=A0 I still see=20=

> FAT structures on the drive, as well as data, but I'm having a=20
> difficult time importing it into Autopsy for examination.=A0 Choosing=20=

> NTFS as the image filesystem doesn't seem correct, since the data I=20
> want to access is in the residual FAT structures.=A0 Choosing a FAT=20
> filesystem doesn't work, because of the current NTFS format of the=20
> filesystem.=A0 Are there any simple methods I can use to salvage FAT=20=

> structures and files through Sleuthkit/Autopsy?


Sleuth Kit and Autopsy can't repair damaged file systems.

brian=