Re: [sleuthkit-users] Examining RAID-5 with only 1 drive
Brought to you by:
carrier
Menu
▾
▴
Re: [sleuthkit-users] Examining RAID-5 with only 1 drive
|
From: DePriest, J. R. <jrd...@gm...> - 2006-11-15 19:48:57
|
The SCSI drive produces this output:
A70067@ebizsrvb /sleuthkit/sleuthkit/bin
$ ./img_stat -i raw -v /dev/sdd
img_open: Type: raw NumImg: 1 Img1: /dev/sdd
IMAGE FILE INFORMATION
--------------------------------------------
Image Type: raw
Size in bytes: 18209320960
A70067@ebizsrvb /sleuthkit/sleuthkit/bin
$ ./mmls -t dos -i raw -v /dev/sdd
img_open: Type: raw NumImg: 1 Img1: /dev/sdd
dos_load_prim: Table Sector: 0
raw_read_random: byte offset: 0 len: 512
load_pri:0:0 Start: 0 Size: 0 Type: 0
load_pri:0:1 Start: 0 Size: 0 Type: 0
load_pri:0:2 Start: 63 Size: 16002 Type: 18
load_pri:0:3 Start: 0 Size: 0 Type: 0
DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors
Slot Start End Length Description
00: ----- 0000000000 0000000000 0000000001 Primary Table (#0)
01: ----- 0000000001 0000000062 0000000062 Unallocated
02: 00:02 0000000063 0000016064 0000016002 Hibernation (0x12)
03: ----- 0000016065 0035565079 0035549015 Unallocated
A70067@ebizsrvb /sleuthkit/sleuthkit/bin
dls and ils produce identical errors:
img_open: Type: raw NumImg: 1 Img1: /dev/sdd
fsopen: Auto detection mode at offset 0
raw_read_random: byte offset: 0 len: 512
raw_read_random: byte offset: 0 len: 512
raw_read_random: byte offset: 1024 len: 1024
raw_read_random: byte offset: 65536 len: 1536
raw_read_random: byte offset: 262144 len: 1536
raw_read_random: byte offset: 8192 len: 1536
iso9660_open img_info: 268566976 ftype: 112 test: 1
raw_read_random: byte offset: 32768 len: 7
get_vol_desc Bad volume descriptor: Magic
number is not CD001Cannot determine file system type
So I am extracting strings from the partition labeled 'Hibernation'
and hopefully that will be good enough.
Any other ideas?
-Jason
--
+ + + NO CARRIER
|
