Difference between pages "Disabling Macintosh Disk Arbitration Daemon" and "Ext2"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
m
 
(Added ext3 link)
 
Line 1: Line 1:
−
#Start Terminal (in the Utilities folder).
+
'''ext2''' or the '''second extended file system''' is a [[Linux]] filesystem designed as a replacement for ext. Note that [[ext3]] is mostly compatible with ext2.
−
#Type:
+
 
−
  cd /etc/mach_init.d
+
The [[SleuthKit]] and [[R-Studio]] can be used to perform recovery of data from the EXT2 filesystem. Various data carving tools like [[Foremost]] and [[Scalpel]] also support the ext2 filesystem.
−
  ls
+
 
−
#Look for the file called diskarbitrationd.plist. If this file is in this directory, then disk arbitration is turned on. The disk arbitration file will attempt to mount any device it sees connected to the Mac, so one way you can stop disk arbitration from mounting the suspect's drive is by hiding this file. Simply renaming the file may not work. To do this, store a backup copy of diskarbitrationd.plist under the root directory and then delete the original.  
+
== See Also ==
−
#Type
+
* [[ext3]]
−
  sudo cp diskarbitrationd.plist /
+
 
−
#Confirm that the copy is there.
+
== External Links ==
−
  ls /
+
 
−
#Remove the original file from the '''mach-int.d''' directory by typing:
+
* [http://en.wikipedia.org/wiki/Ext2 Wikipedia article on EXT2]
−
  sudo rm diskarbitrationd.plist.
+
* [http://www.nongnu.org./ext2-doc/ext2.html Layout of the EXT2 Filesystem]
−
#You can restore disk arbitration when your done by typing:
+
* [http://fedora.linuxsir.org/doc/ext2undelete/Ext2fs-Undeletion.html Linux Ext2fs Undeletion mini-HOWTO]
−
    sudo cp /diskarbitrationd.plist /etc/mach_init.d.
+
* [http://unixsadm.blogspot.com/2007/11/ext2-filesystem-for-linux-and-solaris.html Using ext2 on other systems]
−
You can leave the copy in root for the next time, as it will have no effect on your system if it is left in that directory.
+
 
 +
[[Category:Disk file systems]]

Revision as of 07:29, 20 December 2007

ext2 or the second extended file system is a Linux filesystem designed as a replacement for ext. Note that ext3 is mostly compatible with ext2.

The SleuthKit and R-Studio can be used to perform recovery of data from the EXT2 filesystem. Various data carving tools like Foremost and Scalpel also support the ext2 filesystem.

See Also

External Links

Retrieved from "http://www.forensicswiki.org/w/index.php?title=Disabling_Macintosh_Disk_Arbitration_Daemon&oldid=7917"