Re: [sleuthkit-users] Exfat recovery

[Dennis Z. <de...@es...>]

0100000: eb76 9045 5846 4154 2020 2000 0000 0000  .v.EXFAT   .....

On Sat, Jan 31, 2015 at 4:28 AM, Tim Hoffecker <tho...@gm...>
wrote:

> What does the VBR look like
>
> xxd -l 512 -s 1048576 disk.img
>
> On Jan 30, 2015, at 9:17 PM, Dennis Zheleznyak <de...@es...>
> wrote:
>
> Tried that:
> [root@localhost bin]# ./fls -o 2048 /home/dennis/Documents/disk.img
> Cannot determine file system type
>
>
> On Sat, Jan 31, 2015 at 4:14 AM, Kalin KOZHUHAROV <me....@gm...>
> wrote:
>
>>
>> On Jan 31, 2015 11:11 AM, "Dennis Zheleznyak" <de...@es...>
>> wrote:
>> > [root@localhost bin]# ./mmls  /home/dennis/Documents/disk.img
>> > DOS Partition Table
>> > Offset Sector: 0
>> > Units are in 512-byte sectors
>> >
>> >      Slot    Start        End          Length       Description
>> > 00:  Meta    0000000000   0000000000   0000000001   Primary Table (#0)
>> > 01:  -----   0000000000   0000002047   0000002048   Unallocated
>> > 02:  00:00   0000002048   0124735487   0124733440   Win95 FAT32 (0x0c)
>> >
>> >
>> So add -o 2048 to that fls command.
>>
>> Kalin.
>>
>
>
> ------------------------------------------------------------------------------
> Dive into the World of Parallel Programming. The Go Parallel Website,
> sponsored by Intel and developed in partnership with Slashdot Media, is
> your
> hub for all things parallel software development, from weekly thought
> leadership blogs to news, videos, case studies, tutorials and more. Take a
> look and join the conversation now.
> http://goparallel.sourceforge.net/_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>
>