Difference between pages "Identifying file systems" and "Data Recovery Stories"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m (New page: There are many ways to identify a file system inside a partition. When an operating system attempts to mount a partition, it may use the ID from the partition table. There are several to...)
 
m (New page: Amazing stories of data recovery. * [http://blocksandfiles.com/article/5056 May 6, 2008 - Kroll recovers over 90% of the data from a 400MB hard drive that was on Shuttle Columbia when it ...)
 
Line 1: Line 1:
There are many ways to identify a file system inside a partition.
+
Amazing stories of data recovery.
  
When an operating system attempts to mount a partition, it may use the ID from the partition table.
+
* [http://blocksandfiles.com/article/5056 May 6, 2008 - Kroll recovers over 90% of the data from a 400MB hard drive that was on Shuttle Columbia when it burned up on reentry into Earth's atmosphere.]
 
+
<img src='http://blocksandfiles.com/contentimages/small/shuttle-breakup1.jpg'>
There are several tools that can identify the partition from the data it contains, including:
+
* [[blkid]]
+
* [[parted]]
+
 
+
In general you should not rely on the partition record for determining the partition type.
+
 
+
Some of the test images created for the [http://wiki.sleuthkit.org/index.php?title=Case_Studies Honeynet Challenges] have multiple file systems contained in a single partition.
+

Revision as of 23:17, 6 May 2008

Amazing stories of data recovery.

<img src='http://blocksandfiles.com/contentimages/small/shuttle-breakup1.jpg'>