| 1 |
On Thu, 17 May 2007 16:38:44 +0100 |
| 2 |
Mick <michaelkintzios@×××××.com> wrote: |
| 3 |
|
| 4 |
> On Thursday 17 May 2007 15:45, Dan Farrell wrote: |
| 5 |
> > On Thu, 17 May 2007 12:36:25 +0100 |
| 6 |
> > |
| 7 |
> > Mick <michaelkintzios@×××××.com> wrote: |
| 8 |
> |
| 9 |
> > > |
| 10 |
> > > I tried to dd the boot sector so that I can look at it on my hard |
| 11 |
> > > drive, but it cannot access /dev/sda. Is there anything that I |
| 12 |
> > > can do with my Gentoo to recover the files on this USB? |
| 13 |
> > |
| 14 |
> > have you tried reading raw from the device like |
| 15 |
> > |
| 16 |
> > | dd if=/dev/sda of=sda.image |
| 17 |
> > |
| 18 |
> > ? That might do the recovery. How to get it out of the image is |
| 19 |
> > the same problem but once the backup succeeds you can plug it into a |
| 20 |
> > windows xp box and reformat, and you will probably end up with the |
| 21 |
> > same partition structure as originally. Then you can try to read |
| 22 |
> > the right part of the image out of the image, once you get the |
| 23 |
> > numbers from fdisk on the newly formatted drive, and end up with an |
| 24 |
> > image of sda1. From there you should be able to mount sda1 and |
| 25 |
> > read out the data, if it isn't corrupted. |
| 26 |
> |
| 27 |
> Thanks Dan, as I said above I tried to extract the MBR out of it by |
| 28 |
> running: |
| 29 |
> |
| 30 |
> dd if=/dev/sda of=/tmp/r1 bs=512 |
| 31 |
> |
| 32 |
> But couldn't access it whatsoever. |
| 33 |
> |
| 34 |
> > I also am wondering what happened to the partition table. I bet |
| 35 |
> > your coworker has a security-compromised box at home (oh, runs |
| 36 |
> > windows? right...) At any rate, if the data is recoverable, it may |
| 37 |
> > be possible to rebuild the partition table if you can find out |
| 38 |
> > where the partition started and ended. People have done it before, |
| 39 |
> > i've read online about it. |
| 40 |
> |
| 41 |
Hmm! Perhaps its broken. |
| 42 |
-- |
| 43 |
gentoo-user@g.o mailing list |
Archives