Re: [sleuthkit-users] Recovering files from damaged disk

[Paul B. <p.j...@br...>]

Hi Colby,

While you could manually put all the parts together.. It is easier to 
let dd do it for you!..

Just use dd with conv=noerror,sync as arguments..

This way all unreadable data is written as a 0 on the destination and dd 
continues on after an error...

dd if=/dev/hdXX of=imagefile conv=noerror,sync bs=1k

(Take bs small as that is the size of data is "skips" on error If you 
want to be REALLY thorough use bs=1, but be ready to wait for a LONG time!)

I hope this helps,
Paul Bakker

Colby Gutierrez-Kraybill wrote:

>
> Hello,
>
> I am attempting to recover data from a physically damaged disk.  I  
> was able to dd
> the first GB (including partition info) of the disk and I can run the  
> sleuthkit tools
> and do find some useful info on it.  However, to get at the rest of  
> the disk, I manually
> skipped past the damaged sectors on disk using dd and was able to  
> read another
> much larger block of data (16GB) and then some shorter sections after  
> that
> (5x500MB each).  I noted down which sectors this blocks were started  
> physically
> on the slice.  Now I am trying to sort out if I can put these pieces  
> back together
> enough so that I can use the regular sleuthkit tools on the whole  
> fragmented
> mess.  Is this doable?  Is there a recipe for working through this?
>
> - Colby
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log 
> files
> for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
> http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>