Re: [sleuthkit-users] (no subject)

[<gim...@we...>]

On Mon, 27 Mar 2006 10:14:23 -0500
Carlton Foster <c.a...@LA...> wrote:

> I was asked to create an image of a system a couple of weeks ago but 
> told not to investigate it.  I used dcfldd over netcat on a crossover 
> cable to image the system.  I created MD5's of the source and image, 
> and both matched.
> 
> I did a physical image, not logical.
> 
> Today, I have been asked to investigate the image.  However, the 
> partition table appears bad.
> 
> I am getting warnings from fdisk saying Partition 1 has different 
> logical/physical endings.  Then Partition 2 has different beginnings 
> and endings.  I can't figure out how to get the logical images 
> extracted, and we no longer have access to the source system.
> 
> Can anyone provide any help?
> -- 

Try out this one: http://www.cgsecurity.org/wiki/TestDisk

From the summary:

"If you have missing partitions or a completely empty Partition Table,
TestDisk can search for partitions and create a new Table or even a new
MBR if necessary."

regards