Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.misc > #14563

Re: scanning HD data

Show all headers | View raw

On 15/04/15 18:09, Chick Tower wrote:
> On 2015-04-14, Bill Cunningham <nospam@nspam.invalid> wrote:
>>      Can you use find and grep to scan /dev/sda1 or so and match what comes
>> through there to a hexdump of XX1 ? And get the address of the sector where
>> that file has its' beginning and end?
>
> Regardless of what tools you use, I think it would be very difficult to
> do what you ask for a file that occupies multiple sectors, unless you just
> happen to be lucky enough that the file occupies consecutive sectors.
> Maybe I misunderstand you, but it sounds like you want to scan the data
> on the hard drive while bypassing the file system, but the file system
> is what knows where all the parts of a file are located on the disk.
>
> As little as I know about hard drives and file systems, it may be that
> each sector, in addition to the data it stores, also stores information
> about which sector holds the next part of the file, if there is any more
> to the file.  Whether it is the file system or the hard drive itself
> that tracks the sectors used by each file, though, if you are trying to
> bypass the file system, it probably will take special forensic tools to
> do what you asked, just as someone suggested earlier.
>
> You mentioned that you might want to scan for a match to a 250MB
> hex-dump of a file.  Do you work for the MPAA or RIAA?    :)
>
If the data IS in a file  and the file structure IS intact then it makes 
MORE sense to scan the filesystem as a filesystem.

With decent caching the overhead on speed wont be that long.



-- 
Everything you read in newspapers is absolutely true, except for the 
rare story of which you happen to have first-hand knowledge. – Erwin Knoll

Back to comp.os.linux.misc | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

scanning HD data "Bill Cunningham" <nospam@nspam.invalid> - 2015-04-14 16:00 -0400
  Re: scanning HD data Vilmos Soti <vilmos@soti.ca> - 2015-04-14 13:14 -0700
    Re: scanning HD data "Bill Cunningham" <nospam@nspam.invalid> - 2015-04-14 16:18 -0400
  Re: scanning HD data Andreas Kohlbach <apr15.7.ankman@spamgourmet.net> - 2015-04-14 16:15 -0400
  Re: scanning HD data Eli the Bearded <*@eli.users.panix.com> - 2015-04-14 20:17 +0000
    Re: scanning HD data "Bill Cunningham" <nospam@nspam.invalid> - 2015-04-14 16:23 -0400
      Re: scanning HD data root <NoEMail@home.org> - 2015-04-14 22:00 +0000
      Re: scanning HD data Eli the Bearded <*@eli.users.panix.com> - 2015-04-14 23:20 +0000
        Re: scanning HD data "Bill Cunningham" <nospam@nspam.invalid> - 2015-04-14 19:59 -0400
          Re: scanning HD data Eli the Bearded <*@eli.users.panix.com> - 2015-04-15 00:43 +0000
            Re: scanning HD data "Bill Cunningham" <nospam@nspam.invalid> - 2015-04-14 21:09 -0400
            Re: scanning HD data "Bill Cunningham" <nospam@nspam.invalid> - 2015-04-15 14:35 -0400
      Re: scanning HD data Chick Tower <c.tower@deadspam.com> - 2015-04-15 17:09 +0000
        Re: scanning HD data The Natural Philosopher <tnp@invalid.invalid> - 2015-04-15 18:26 +0100
        Re: scanning HD data "Bill Cunningham" <nospam@nspam.invalid> - 2015-04-15 14:27 -0400
  Re: scanning HD data Baho Utot <baho-utot@columbus.rr.com> - 2015-04-14 18:42 -0400
    Re: scanning HD data "Bill Cunningham" <nospam@nspam.invalid> - 2015-04-14 19:28 -0400
  Re: scanning HD data James Moe <jimoeDESPAM@sohnen-moe.com> - 2015-04-15 11:24 -0700

csiph-web