Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.os.linux.misc > #14561
| From | Chick Tower <c.tower@deadspam.com> |
|---|---|
| Newsgroups | comp.os.linux.misc |
| Subject | Re: scanning HD data |
| Date | 2015-04-15 17:09 +0000 |
| Organization | A noiseless patient Spider |
| Message-ID | <mgm613$ta7$1@dont-email.me> (permalink) |
| References | <mgjrim$7n8$1@dont-email.me> <eli$1504141617@qz.little-neck.ny.us> <mgjstn$d79$1@dont-email.me> |
On 2015-04-14, Bill Cunningham <nospam@nspam.invalid> wrote:
> Can you use find and grep to scan /dev/sda1 or so and match what comes
> through there to a hexdump of XX1 ? And get the address of the sector where
> that file has its' beginning and end?
Regardless of what tools you use, I think it would be very difficult to
do what you ask for a file that occupies multiple sectors, unless you just
happen to be lucky enough that the file occupies consecutive sectors.
Maybe I misunderstand you, but it sounds like you want to scan the data
on the hard drive while bypassing the file system, but the file system
is what knows where all the parts of a file are located on the disk.
As little as I know about hard drives and file systems, it may be that
each sector, in addition to the data it stores, also stores information
about which sector holds the next part of the file, if there is any more
to the file. Whether it is the file system or the hard drive itself
that tracks the sectors used by each file, though, if you are trying to
bypass the file system, it probably will take special forensic tools to
do what you asked, just as someone suggested earlier.
You mentioned that you might want to scan for a match to a 250MB
hex-dump of a file. Do you work for the MPAA or RIAA? :)
--
Chick Tower
For e-mail: colm DOT sent DOT towerboy AT xoxy DOT net
Back to comp.os.linux.misc | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
scanning HD data "Bill Cunningham" <nospam@nspam.invalid> - 2015-04-14 16:00 -0400
Re: scanning HD data Vilmos Soti <vilmos@soti.ca> - 2015-04-14 13:14 -0700
Re: scanning HD data "Bill Cunningham" <nospam@nspam.invalid> - 2015-04-14 16:18 -0400
Re: scanning HD data Andreas Kohlbach <apr15.7.ankman@spamgourmet.net> - 2015-04-14 16:15 -0400
Re: scanning HD data Eli the Bearded <*@eli.users.panix.com> - 2015-04-14 20:17 +0000
Re: scanning HD data "Bill Cunningham" <nospam@nspam.invalid> - 2015-04-14 16:23 -0400
Re: scanning HD data root <NoEMail@home.org> - 2015-04-14 22:00 +0000
Re: scanning HD data Eli the Bearded <*@eli.users.panix.com> - 2015-04-14 23:20 +0000
Re: scanning HD data "Bill Cunningham" <nospam@nspam.invalid> - 2015-04-14 19:59 -0400
Re: scanning HD data Eli the Bearded <*@eli.users.panix.com> - 2015-04-15 00:43 +0000
Re: scanning HD data "Bill Cunningham" <nospam@nspam.invalid> - 2015-04-14 21:09 -0400
Re: scanning HD data "Bill Cunningham" <nospam@nspam.invalid> - 2015-04-15 14:35 -0400
Re: scanning HD data Chick Tower <c.tower@deadspam.com> - 2015-04-15 17:09 +0000
Re: scanning HD data The Natural Philosopher <tnp@invalid.invalid> - 2015-04-15 18:26 +0100
Re: scanning HD data "Bill Cunningham" <nospam@nspam.invalid> - 2015-04-15 14:27 -0400
Re: scanning HD data Baho Utot <baho-utot@columbus.rr.com> - 2015-04-14 18:42 -0400
Re: scanning HD data "Bill Cunningham" <nospam@nspam.invalid> - 2015-04-14 19:28 -0400
Re: scanning HD data James Moe <jimoeDESPAM@sohnen-moe.com> - 2015-04-15 11:24 -0700
csiph-web