|−|#Start Terminal (in the Utilities folder). |+|
the file . is .
|−| cd /etc/mach_init.d |+|
The to from the . and the .
|−| ls |+|
|−|#Look for the file called diskarbitrationd. plist. If this file is in this directory, then disk arbitration is turned on. The disk arbitration file will attempt to mount any device it sees connected to the Mac, so one way you can stop disk arbitration from mounting the suspect's drive is by hiding this file. Simply renaming the file may not work. To do this, store a backup copy of diskarbitrationd.plist under the root directory and then delete the original. |+|
|−| sudo cp diskarbitrationd. plist / |+|
|−|#Confirm that the copy is there. |+|
|−| ls / |+|
|−|#Remove the original file from the '''mach- int. d''' directory by typing: |+|
|−| sudo rm diskarbitrationd. plist. |+|
|−|#You can restore disk arbitration when your done by typing: |+|
|−| sudo cp / diskarbitrationd. plist / etc/ mach_init. d. |+|
|−|You can leave the copy in root for the next time, as it will have no effect on your system if it is left in that directory. |+|
Revision as of 12:29, 20 December 2007
ext2 or the second extended file system is a Linux filesystem designed as a replacement for ext. Note that ext3 is mostly compatible with ext2.
The SleuthKit and R-Studio can be used to perform recovery of data from the EXT2 filesystem. Various data carving tools like Foremost and Scalpel also support the ext2 filesystem.