Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.os.linux.misc > #14566
| From | "Bill Cunningham" <nospam@nspam.invalid> |
|---|---|
| Newsgroups | comp.os.linux.misc |
| Subject | Re: scanning HD data |
| Date | 2015-04-15 14:35 -0400 |
| Organization | A noiseless patient Spider |
| Message-ID | <mgmav1$ijn$1@dont-email.me> (permalink) |
| References | <mgjrim$7n8$1@dont-email.me> <mgjstn$d79$1@dont-email.me> <eli$1504141920@qz.little-neck.ny.us> <mgk9ir$qf3$1@dont-email.me> <eli$1504142042@qz.little-neck.ny.us> |
"Eli the Bearded" <*@eli.users.panix.com> wrote in message
news:eli$1504142042@qz.little-neck.ny.us...
> I found you the byte offset. Everything else is filesystem dependent.
> You can dig around and trace the entire fs data structures until you get
> your answer.
>
> Or you can use my original approach, find the file, get it's inode and
> then where to look in the fs data structures will be more
> straight-forward.
>
> If you are doing data-forensics, the 'dd|grep' one is probably a better
> path than 'find|grep', but suit yourself.
>
> Elijah
> ------
> a unix forensics toolkit would be a good thing to try for this problem
Would sleuthkit be what you mean. It sounds like it might be. I hope to
have nothing ever crash on me again now with "testdisk".
Bill
Back to comp.os.linux.misc | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
scanning HD data "Bill Cunningham" <nospam@nspam.invalid> - 2015-04-14 16:00 -0400
Re: scanning HD data Vilmos Soti <vilmos@soti.ca> - 2015-04-14 13:14 -0700
Re: scanning HD data "Bill Cunningham" <nospam@nspam.invalid> - 2015-04-14 16:18 -0400
Re: scanning HD data Andreas Kohlbach <apr15.7.ankman@spamgourmet.net> - 2015-04-14 16:15 -0400
Re: scanning HD data Eli the Bearded <*@eli.users.panix.com> - 2015-04-14 20:17 +0000
Re: scanning HD data "Bill Cunningham" <nospam@nspam.invalid> - 2015-04-14 16:23 -0400
Re: scanning HD data root <NoEMail@home.org> - 2015-04-14 22:00 +0000
Re: scanning HD data Eli the Bearded <*@eli.users.panix.com> - 2015-04-14 23:20 +0000
Re: scanning HD data "Bill Cunningham" <nospam@nspam.invalid> - 2015-04-14 19:59 -0400
Re: scanning HD data Eli the Bearded <*@eli.users.panix.com> - 2015-04-15 00:43 +0000
Re: scanning HD data "Bill Cunningham" <nospam@nspam.invalid> - 2015-04-14 21:09 -0400
Re: scanning HD data "Bill Cunningham" <nospam@nspam.invalid> - 2015-04-15 14:35 -0400
Re: scanning HD data Chick Tower <c.tower@deadspam.com> - 2015-04-15 17:09 +0000
Re: scanning HD data The Natural Philosopher <tnp@invalid.invalid> - 2015-04-15 18:26 +0100
Re: scanning HD data "Bill Cunningham" <nospam@nspam.invalid> - 2015-04-15 14:27 -0400
Re: scanning HD data Baho Utot <baho-utot@columbus.rr.com> - 2015-04-14 18:42 -0400
Re: scanning HD data "Bill Cunningham" <nospam@nspam.invalid> - 2015-04-14 19:28 -0400
Re: scanning HD data James Moe <jimoeDESPAM@sohnen-moe.com> - 2015-04-15 11:24 -0700
csiph-web