[sleuthkit-users] Recovering files from damaged disk
Brought to you by:
carrier
From: Colby Gutierrez-K. <co...@ge...> - 2005-12-30 19:52:34
|
Hello, I am attempting to recover data from a physically damaged disk. I was able to dd the first GB (including partition info) of the disk and I can run the sleuthkit tools and do find some useful info on it. However, to get at the rest of the disk, I manually skipped past the damaged sectors on disk using dd and was able to read another much larger block of data (16GB) and then some shorter sections after that (5x500MB each). I noted down which sectors this blocks were started physically on the slice. Now I am trying to sort out if I can put these pieces back together enough so that I can use the regular sleuthkit tools on the whole fragmented mess. Is this doable? Is there a recipe for working through this? - Colby |