sleuthkit-users

[sleuthkit-users] wrong filesystem ?

[Antoine J. <aja...@lp...>]

Hi !

I am new to data recovery.
I stupidly "rm" the content of an entire partition under FreeBSD.
Of course, the data was very important, so I decided using the 
sleuthkit+autopsy.
Now, after issuing the command:
"bin/dls -be -f freebsd /dev/ad5s1e > /mnt/image.dd",
I have after a couple of hours, an image.dd file that's 28Go big. Until 
that, no problem.
After that, I want to use autopsy to search the image content, but when 
I tell him to add /mnt/image.dd it tells me this is not a freebsd 
filesystem image ...
What did I do wrong ?

Thanks a lot for your help.

Regards.

Antoine

Re: [sleuthkit-users] wrong filesystem ?

[Brian C. <ca...@sl...>]

Antoine Jacoutot <aja...@lp...> said:

> Hi !
> 
> I am new to data recovery.
> I stupidly "rm" the content of an entire partition under FreeBSD.
> Of course, the data was very important, so I decided using the 
> sleuthkit+autopsy.
> Now, after issuing the command:
> "bin/dls -be -f freebsd /dev/ad5s1e > /mnt/image.dd",
> I have after a couple of hours, an image.dd file that's 28Go big.
Until 
> that, no problem.
> After that, I want to use autopsy to search the image content, but
when 
> I tell him to add /mnt/image.dd it tells me this is not a freebsd 
> filesystem image ...
> What did I do wrong ?

Antoine,

The 'dls -e' should be equivalent to using 'dd'.  So, I would expect
it to work.  What happens if you use 'dd' and grab the first 100 MB
and run the sleuth kit tools on that:

# dd if=/dev/ad5s1e of=/mnt/image2.dd bs=1m count=100
# bin/fls -f freebsd /mnt/image2.dd

It will likely report a read error, but it should pass the initial
sanity check.  If so, then the 'dls' did not make the right image. 
You may want to run 'fls' on the image.dd file as well because there
could be an error in the autopsy check (It was just added to the last
release).

thanks,
brian

Re: [sleuthkit-users] wrong filesystem ?

[Antoine J. <aja...@lp...>]

On Monday 19 May 2003 21:20, Brian Carrier wrote:
> The 'dls -e' should be equivalent to using 'dd'.  So, I would expect
> it to work.  What happens if you use 'dd' and grab the first 100 MB
> and run the sleuth kit tools on that:

It did work, thanks a lot :)
Now, I don't want to ask stupid questions on the list, so I was 
wondering if there was some kind of howto somewhere for recovering 
files.
I tried to use the Coroner Toolkit before knowing about your software, 
but I realised that it would take a month of more to recover my data 
(30Go), so I was wondering if there was a way to extract only the 
needed data from the image instead of all.
Englidh is not my first language and I'm having a hard time 
understanding autopsy.

Thanks a lot for your former answer.

Regards.

Antoine

Re: [sleuthkit-users] wrong filesystem ?

[Brian C. <ca...@sl...>]

Antoine Jacoutot <aja...@lp...> said:

> On Monday 19 May 2003 21:20, Brian Carrier wrote:
> > The 'dls -e' should be equivalent to using 'dd'.  So, I would expect
> > it to work.  What happens if you use 'dd' and grab the first 100 MB
> > and run the sleuth kit tools on that:
> 
> It did work, thanks a lot :)

Can you image the partition with 'dd' and compare it with the 'dls' iimage?  They 
"should" be the same since you gave 'eb'.  Are they the same size?  

> Now, I don't want to ask stupid questions on the list, so I was 
> wondering if there was some kind of howto somewhere for recovering 
> files.
> I tried to use the Coroner Toolkit before knowing about your software, 
> but I realised that it would take a month of more to recover my data 
> (30Go), so I was wondering if there was a way to extract only the 
> needed data from the image instead of all.

Actually, there is no "easy" way to recover files.  If the file types have a structure that 
is known by 'foremost' (on sourceforge), then you can run it (on Linux only) and 
recover some of the data.    

The 'dls' tool with out the 'eb' will extract the unallocated space, so that will allow you 
to just run foremost or keyword searches on just the unallocated space.  Freebsd 
deletes the pointers from the inode structure to the data fragments, so there is no 
easy way to recover.  The last issue of the Sleuth Kit Informer had a quick blurb on 
using the group layout of a UNIX file system to recover files:

    www.sleuthkit.org/informer

brian

Re: [sleuthkit-users] wrong filesystem ?

[Antoine J. <aja...@lp...>]

On Tuesday 20 May 2003 16:49, Brian Carrier wrote:
> The 'dls' tool with out the 'eb' will extract the unallocated space,
> so that will allow you to just run foremost or keyword searches on
> just the unallocated space.  Freebsd deletes the pointers from the
> inode structure to the data fragments, so there is no easy way to
> recover.  The last issue of the Sleuth Kit Informer had a quick blurb
> on using the group layout of a UNIX file system to recover files:

OK, I'll have a deeper lookt on all of that.
Thanks a lot for you suggestions.

Antoine