Thread: [sleuthkit-users] Corrupted floppy

Brought to you by: carrier

sleuthkit-users

[sleuthkit-users] Corrupted floppy

From: Pradeep M <pra...@gm...> - 2005-04-25 10:15:16

Hi=20
        Is it possible to recover data from  a corrupted floppy using
sleuthkit and autopsy.
I tried using the tool but first of all its not possible to mount the
floppy itself. I want to know whether it is possible to recover data
from a corrupted floppy using this tool and if its not possible then
which tool should be used. Pls help.

Pradeep

Re: [sleuthkit-users] Corrupted floppy

From: Brian C. <ca...@sl...> - 2005-04-25 14:18:54

How do you mean "corrupted"?  Is the file system corrupt or is the 
physical media damaged and it generates errors when you try to read it? 
  If it is physical damage, then TSK / Autopsy will not help.  If it is 
file system corruption, then you can try them but they will not fix any 
errors that exist.  You can also make  an image of the floppy using 
'dd' and then run fsck on a copy so that it fixes any errors.

brian

On Apr 25, 2005, at 5:15 AM, Pradeep M wrote:

> Hi
>         Is it possible to recover data from  a corrupted floppy using
> sleuthkit and autopsy.
> I tried using the tool but first of all its not possible to mount the
> floppy itself. I want to know whether it is possible to recover data
> from a corrupted floppy using this tool and if its not possible then
> which tool should be used. Pls help.
>

Re: [sleuthkit-users] Corrupted floppy

From: Enda C. <en...@co...> - 2005-04-25 16:26:48

when dd'ing a floppy, try using bs=1 and conv=noerror, then mounting the
image under loopback.

Have had sucess recovering some files which suffered the "thesis field
effect" that way where there was physical damage to the disk. Document
probably won't be 100% intact, but the majority of the content was
recoverable.

HTH,

 -Enda.

----- Original Message ----- 
From: "Brian Carrier" <ca...@sl...>
To: "Pradeep M" <pra...@gm...>
Cc: <sle...@li...>
Sent: Monday, April 25, 2005 3:18 PM
Subject: Re: [sleuthkit-users] Corrupted floppy


> How do you mean "corrupted"?  Is the file system corrupt or is the
> physical media damaged and it generates errors when you try to read it?
>   If it is physical damage, then TSK / Autopsy will not help.  If it is
> file system corruption, then you can try them but they will not fix any
> errors that exist.  You can also make  an image of the floppy using
> 'dd' and then run fsck on a copy so that it fixes any errors.
>
> brian
>
>
>
> On Apr 25, 2005, at 5:15 AM, Pradeep M wrote:
>
> > Hi
> >         Is it possible to recover data from  a corrupted floppy using
> > sleuthkit and autopsy.
> > I tried using the tool but first of all its not possible to mount the
> > floppy itself. I want to know whether it is possible to recover data
> > from a corrupted floppy using this tool and if its not possible then
> > which tool should be used. Pls help.
> >
>
>
>
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

RE: [sleuthkit-users] Corrupted floppy

From: Bradley B <br...@de...> - 2005-05-01 00:33:48

When using conv=noerror it will begin writing to the file when it can read
more data, which will prevent offsets from being correct. A solution is
conv=sync,noerror where it will write zeroes when it has an error reading
the disk. I find using sleuthkit and autopsy to recover files on a damaged
filesystem is more successful than using the operating system and trying to
access the data.

-----Original Message-----
From: sle...@li...
[mailto:sle...@li...] On Behalf Of Enda
Cronnolly
Sent: Monday, April 25, 2005 12:33 PM
To: sle...@li...
Subject: Re: [sleuthkit-users] Corrupted floppy


when dd'ing a floppy, try using bs=1 and conv=noerror, then mounting the
image under loopback.

Have had sucess recovering some files which suffered the "thesis field
effect" that way where there was physical damage to the disk. Document
probably won't be 100% intact, but the majority of the content was
recoverable.

HTH,

 -Enda.

----- Original Message ----- 
From: "Brian Carrier" <ca...@sl...>
To: "Pradeep M" <pra...@gm...>
Cc: <sle...@li...>
Sent: Monday, April 25, 2005 3:18 PM
Subject: Re: [sleuthkit-users] Corrupted floppy


> How do you mean "corrupted"?  Is the file system corrupt or is the
> physical media damaged and it generates errors when you try to read it?
>   If it is physical damage, then TSK / Autopsy will not help.  If it is
> file system corruption, then you can try them but they will not fix any
> errors that exist.  You can also make  an image of the floppy using
> 'dd' and then run fsck on a copy so that it fixes any errors.
>
> brian
>
>
>
> On Apr 25, 2005, at 5:15 AM, Pradeep M wrote:
>
> > Hi
> >         Is it possible to recover data from  a corrupted floppy using
> > sleuthkit and autopsy.
> > I tried using the tool but first of all its not possible to mount the
> > floppy itself. I want to know whether it is possible to recover data
> > from a corrupted floppy using this tool and if its not possible then
> > which tool should be used. Pls help.
> >
>
>
>
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

Re: [sleuthkit-users] Corrupted floppy

From: Enda C. <en...@co...> - 2005-05-01 21:11:38

I find that when accessing a damaged floppy from windows / linux through an
application, when it can't read to EOF it refuses to display what it can
read resulting in you not being able to retrieve any data. Even without the
padded zero's, you will be able to read a corrupted file from the image
through to EOF, and it will display all that is available despite the file
integrity. Typically you loose a lot of formatting etc, and have to fish out
the relevant info. Strings is very useful for that.

 -Enda.

----- Original Message ----- 
From: "Bradley B" <br...@de...>
To: "'Enda Cronnolly'" <en...@co...>
Cc: <sle...@li...>
Sent: Sunday, May 01, 2005 1:33 AM
Subject: RE: [sleuthkit-users] Corrupted floppy


> When using conv=noerror it will begin writing to the file when it can read
> more data, which will prevent offsets from being correct. A solution is
> conv=sync,noerror where it will write zeroes when it has an error reading
> the disk. I find using sleuthkit and autopsy to recover files on a damaged
> filesystem is more successful than using the operating system and trying
to
> access the data.
>
> -----Original Message-----
> From: sle...@li...
> [mailto:sle...@li...] On Behalf Of Enda
> Cronnolly
> Sent: Monday, April 25, 2005 12:33 PM
> To: sle...@li...
> Subject: Re: [sleuthkit-users] Corrupted floppy
>
>
> when dd'ing a floppy, try using bs=1 and conv=noerror, then mounting the
> image under loopback.
>
> Have had sucess recovering some files which suffered the "thesis field
> effect" that way where there was physical damage to the disk. Document
> probably won't be 100% intact, but the majority of the content was
> recoverable.
>
> HTH,
>
>  -Enda.
>
> ----- Original Message ----- 
> From: "Brian Carrier" <ca...@sl...>
> To: "Pradeep M" <pra...@gm...>
> Cc: <sle...@li...>
> Sent: Monday, April 25, 2005 3:18 PM
> Subject: Re: [sleuthkit-users] Corrupted floppy
>
>
> > How do you mean "corrupted"?  Is the file system corrupt or is the
> > physical media damaged and it generates errors when you try to read it?
> >   If it is physical damage, then TSK / Autopsy will not help.  If it is
> > file system corruption, then you can try them but they will not fix any
> > errors that exist.  You can also make  an image of the floppy using
> > 'dd' and then run fsck on a copy so that it fixes any errors.
> >
> > brian
> >
> >
> >
> > On Apr 25, 2005, at 5:15 AM, Pradeep M wrote:
> >
> > > Hi
> > >         Is it possible to recover data from  a corrupted floppy using
> > > sleuthkit and autopsy.
> > > I tried using the tool but first of all its not possible to mount the
> > > floppy itself. I want to know whether it is possible to recover data
> > > from a corrupted floppy using this tool and if its not possible then
> > > which tool should be used. Pls help.
> > >
> >
> >
> >
> > -------------------------------------------------------
> > SF email is sponsored by - The IT Product Guide
> > Read honest & candid reviews on hundreds of IT Products from real users.
> > Discover which products truly live up to the hype. Start reading now.
> > http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> > _______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
> >
>
>
>
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>

Re: [sleuthkit-users] Corrupted floppy

From: Nathan C. <na...@cc...> - 2005-08-16 10:54:05

Sorry for the lag.

I have had success with reading 'damaged' sectors by using fdutils on
linux, this allows you to access the floppy controller at the raw level
(not through the linux floppy driver).

Even if the sector is in error fdutils *will* return data, not zeros as
when using dd. This allows you to:

1) Retry as many times as you want to re-read a particular sector until
you successfully read the sector (unlike the floppy driver in linux
which only retries several times, 3???).

2) Even if the CRC is incorrect recover some data in the sector.

When a floppy is on it's 'way out', use as many drives as you can lay
your hands on, chances are you will find a drive that at some point
*will* read the unreadable sector (unless it has been really badly
damaged).

Basically I ended up writing a perl script to use 'fdrawcmd' with a
ridiculous retry (50) to step through the disk sector-by-sector until it
was read, any sectors that wouldn't CRC check were just added anyway
(with whatever data was there).

This actually solved my problem, the next step would have been to
re-read the sectors in error and analyse the bytes in the read to see if
'good' bytes can be detected (by re-reading the sector and getting some
sort of consistent readings of bytes).

regards,

Nathan


On Sun, 2005-05-01 at 22:17 +0100, Enda Cronnolly wrote:
> I find that when accessing a damaged floppy from windows / linux through an
> application, when it can't read to EOF it refuses to display what it can
> read resulting in you not being able to retrieve any data. Even without the
> padded zero's, you will be able to read a corrupted file from the image
> through to EOF, and it will display all that is available despite the file
> integrity. Typically you loose a lot of formatting etc, and have to fish out
> the relevant info. Strings is very useful for that.
> 
>  -Enda.
> 
> ----- Original Message ----- 
> From: "Bradley B" <br...@de...>
> To: "'Enda Cronnolly'" <en...@co...>
> Cc: <sle...@li...>
> Sent: Sunday, May 01, 2005 1:33 AM
> Subject: RE: [sleuthkit-users] Corrupted floppy
> 
> 
> > When using conv=noerror it will begin writing to the file when it can read
> > more data, which will prevent offsets from being correct. A solution is
> > conv=sync,noerror where it will write zeroes when it has an error reading
> > the disk. I find using sleuthkit and autopsy to recover files on a damaged
> > filesystem is more successful than using the operating system and trying
> to
> > access the data.
> >
> > -----Original Message-----
> > From: sle...@li...
> > [mailto:sle...@li...] On Behalf Of Enda
> > Cronnolly
> > Sent: Monday, April 25, 2005 12:33 PM
> > To: sle...@li...
> > Subject: Re: [sleuthkit-users] Corrupted floppy
> >
> >
> > when dd'ing a floppy, try using bs=1 and conv=noerror, then mounting the
> > image under loopback.
> >
> > Have had sucess recovering some files which suffered the "thesis field
> > effect" that way where there was physical damage to the disk. Document
> > probably won't be 100% intact, but the majority of the content was
> > recoverable.
> >
> > HTH,
> >
> >  -Enda.
> >
> > ----- Original Message ----- 
> > From: "Brian Carrier" <ca...@sl...>
> > To: "Pradeep M" <pra...@gm...>
> > Cc: <sle...@li...>
> > Sent: Monday, April 25, 2005 3:18 PM
> > Subject: Re: [sleuthkit-users] Corrupted floppy
> >
> >
> > > How do you mean "corrupted"?  Is the file system corrupt or is the
> > > physical media damaged and it generates errors when you try to read it?
> > >   If it is physical damage, then TSK / Autopsy will not help.  If it is
> > > file system corruption, then you can try them but they will not fix any
> > > errors that exist.  You can also make  an image of the floppy using
> > > 'dd' and then run fsck on a copy so that it fixes any errors.
> > >
> > > brian
> > >
> > >
> > >
> > > On Apr 25, 2005, at 5:15 AM, Pradeep M wrote:
> > >
> > > > Hi
> > > >         Is it possible to recover data from  a corrupted floppy using
> > > > sleuthkit and autopsy.
> > > > I tried using the tool but first of all its not possible to mount the
> > > > floppy itself. I want to know whether it is possible to recover data
> > > > from a corrupted floppy using this tool and if its not possible then
> > > > which tool should be used. Pls help.
> > > >
> > >
> > >
> > >
> > > -------------------------------------------------------
> > > SF email is sponsored by - The IT Product Guide
> > > Read honest & candid reviews on hundreds of IT Products from real users.
> > > Discover which products truly live up to the hype. Start reading now.
> > > http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> > > _______________________________________________
> > > sleuthkit-users mailing list
> > > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > > http://www.sleuthkit.org
> > >
> >
> >
> >
> > -------------------------------------------------------
> > SF email is sponsored by - The IT Product Guide
> > Read honest & candid reviews on hundreds of IT Products from real users.
> > Discover which products truly live up to the hype. Start reading now.
> > http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> > _______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
> >
> >
> 
> 
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by: NEC IT Guy Games.
> Get your fingers limbered up and give it your best shot. 4 great events, 4
> opportunities to win big! Highest score wins.NEC IT Guy Games. Play to
> win an NEC 61 plasma display. Visit http://www.necitguy.com/?r=20
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org