ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Difference between revisions of "Identifying file systems"

From ForensicsWiki
Jump to: navigation, search
m
m
Line 5: Line 5:
 
There are several tools that can identify the partition from the data it contains, including:
 
There are several tools that can identify the partition from the data it contains, including:
 
* [[blkid]]
 
* [[blkid]]
 +
* [[file]]
 
* [[parted]]
 
* [[parted]]
 
* [[testdisk]]
 
* [[testdisk]]

Revision as of 03:59, 26 April 2008

There are many ways to identify a file system inside a partition.

When an operating system attempts to mount a partition, it may use the ID from the partition table.

There are several tools that can identify the partition from the data it contains, including:

In general you should not rely on the partition record for determining the partition type.

Some of the test images created for the Honeynet Challenges have multiple file systems contained in a single partition.