jess LAND
       www.jessland.net
        Sponsored by:       
One eSecurity
www.one-esecurity.com
JISK Knowledgebase >>    About    News    Essentials    Architecture    FWs    IDS/IPS    Honeypots    Malware    Forensics   
  +  JSS Home    Projects    JSS Community    Events    News    Docs    About    Contact .

JISK > Forensics > Areas > Disks and Filesystems > Recovery Forensics Section Map

Recovery of Deleted / Formatted / Damaged Filesystems

Content Leader: Jess Garcia - Last Updated: March 10, 2007


Filesystem Recovery

Filesystems

  • ext
    • References
      • Advanced Find EXT2 EXT3 Backup SuperBlock
        Note: You can use mke2fs -n to determine the location of the backup superblocks for a particular filesystem (as long as the mke2fs parameters that were passed when the filesystem was originally created are used again).

Tools

  • testdisk: Tool which helps in the recovery of lost partitions and/or makes non-booting disks bootable again.
  • gpart: Tool which tries to guess the primary partition table of a PC-type hard disk in case the primary partition table in sector 0 is damaged, incorrect or deleted.

Bad Block Recovery

Tools

  • Salvation Data - Claims that can read the "bad blocks" of some drives with proprietary commands (not tested).

RAID Recovery


Copyright © 2000-2008 Jessland - Jess Garcia's Website - All rights reserved.