Difference between revisions of "Identifying file systems"

From Forensics Wiki
Jump to: navigation, search
m
m
Line 5: Line 5:
 
There are several tools that can identify the partition from the data it contains, including:
 
There are several tools that can identify the partition from the data it contains, including:
 
* [[blkid]]
 
* [[blkid]]
 +
* [[file]]
 
* [[parted]]
 
* [[parted]]
 
* [[testdisk]]
 
* [[testdisk]]

Revision as of 22:59, 25 April 2008

There are many ways to identify a file system inside a partition.

When an operating system attempts to mount a partition, it may use the ID from the partition table.

There are several tools that can identify the partition from the data it contains, including:

In general you should not rely on the partition record for determining the partition type.

Some of the test images created for the Honeynet Challenges have multiple file systems contained in a single partition.