timwhite/technicallytim

Technically Tim Blog

technicallytim's Issues

Disk recovery - updates

Thanks for the article, it's been very helpful!

A few updates that might save time for the next person to need it:

• instead of the hex calculations and using bc, one can simply use 'ddrescuelog -l- ddrescue.log'. This outputs all the bad ('-') sector numbers in decimal, i.e. it does both the division by sector size and conversion to decimal, and in addition it outputs all the sectors and not just the first one of each series of bad blocks (you mention this in the last paragraph but with no example of how to do this). So this one command takes care of a lot of stuff in one fell swoop.
• in some larger disks nowadays the sector size is 4096 rather than 512. Thus calculating the 'data unit' used in the sleuthkit tools might require an additional division by 8 (after division by 512).
• the version of sleuthkit in Ubuntu (up to 13.10, and it looks like it won't change by the 14.04 release this week) is a couple years old, and as it turns out, does not support ext4. While this is platform-specific (though pretty common platform), the important note is that blkstat works ok, but then ifind says 'inode not found', which is a bit perplexing considering it is marked as 'Allocated'. So the filesystem auto-detection fails silently. Only if one specifies '-f ext4' explicitly does he find out that ext4 is not supported. I had to download and build the latest sleuthkit myself for it to work with ext4 properly.

Thanks once again for this great tutorial!

right,

right, actually I came from your blog :) already checked ur blog post for google + s3 plugin.

there was comment at the bottom that saying, plugin not works.

hope this work for me , thanks