Re: [sleuthkit-users] Examining RAID-5 with only 1 drive

[DePriest, J. R. <jrd...@gm...>]

On 11/21/06, Brian Carrier  wrote:
>
> No, I think you are out of luck.  TSK requires at least a minimal amount
> of basic information from a boot sector / super block and you may not
> even have that in this case since you are missing two of the RAID
> drives.   You may consider looking into testdisk or gpart to see if they
> can scavenge any file system traces from the image.
>
> brian
>

I have something magical to report.

Active File Recovery 7.1 build 333 (commercial program) found an NTFS
partition on the drive.

It starts at sector 1120 and is 35544920 sectors long.  It has the
default NTFS cluster size of 4096.

It seems to have an full Windows file system on it with enough
directories to actually boot and run.

According to AFR, there are exactly 0 (zero) deleted files on it.

I am disturbed by that result.  I can't seem to get the partition
recognized by any of the autopsy tools to verify that number.

-Jason

--