| 1 |
On Thursday 17 May 2007 15:45, Dan Farrell wrote: |
| 2 |
> On Thu, 17 May 2007 12:36:25 +0100 |
| 3 |
> |
| 4 |
> Mick <michaelkintzios@×××××.com> wrote: |
| 5 |
|
| 6 |
> > |
| 7 |
> > I tried to dd the boot sector so that I can look at it on my hard |
| 8 |
> > drive, but it cannot access /dev/sda. Is there anything that I can |
| 9 |
> > do with my Gentoo to recover the files on this USB? |
| 10 |
> |
| 11 |
> have you tried reading raw from the device like |
| 12 |
> |
| 13 |
> | dd if=/dev/sda of=sda.image |
| 14 |
> |
| 15 |
> ? That might do the recovery. How to get it out of the image is the |
| 16 |
> same problem but once the backup succeeds you can plug it into a |
| 17 |
> windows xp box and reformat, and you will probably end up with the same |
| 18 |
> partition structure as originally. Then you can try to read the right |
| 19 |
> part of the image out of the image, once you get the numbers from fdisk |
| 20 |
> on the newly formatted drive, and end up with an image of sda1. From |
| 21 |
> there you should be able to mount sda1 and read out the data, if it |
| 22 |
> isn't corrupted. |
| 23 |
|
| 24 |
Thanks Dan, as I said above I tried to extract the MBR out of it by running: |
| 25 |
|
| 26 |
dd if=/dev/sda of=/tmp/r1 bs=512 |
| 27 |
|
| 28 |
But couldn't access it whatsoever. |
| 29 |
|
| 30 |
> I also am wondering what happened to the partition table. I bet your |
| 31 |
> coworker has a security-compromised box at home (oh, runs windows? |
| 32 |
> right...) At any rate, if the data is recoverable, it may be possible |
| 33 |
> to rebuild the partition table if you can find out where the partition |
| 34 |
> started and ended. People have done it before, i've read online about |
| 35 |
> it. |
| 36 |
|
| 37 |
-- |
| 38 |
Regards, |
| 39 |
Mick |
Archives