Difference between pages "Identifying file systems" and "Data Recovery Stories"
From Forensics Wiki
(Difference between pages)
|−|There are many ways to identify a file system inside a partition. |+|
| || |
|−|When an operating system attempts to mount a partition, it may use the ID from the partition table. |+|
|−|There are several tools that can identify the partition from the data it contains, including: |+|
|−|* [[parted]] |+|
|−|* [[testdisk]] |+|
|−|In general you should not rely on the partition record for determining the partition type. |+|
|−|Some of the test images created for the [http:// wiki. sleuthkit.org/ index. php?title=Case_Studies Honeynet Challenges] have multiple file systems contained in a single partition. |+|
Revision as of 22:17, 6 May 2008
Amazing stories of data recovery.