Win32 Port of TAR

From: Chris Mawer (chris_mawerat_private)
Date: Mon Nov 04 2002 - 14:20:47 PST

  • Next message: Brian C. Lane: "Re: Forensics in a wireless environment"

    Hey all,
    
    Recently came to possession of a 1.98GB Fujitsu internal IDE hard-drive. Its 
    a little old and creaky, and stopped functioning quite as expected. Every 
    time the POST process occurred during bootup, the process would complete, 
    but then the dreaded blue screen of death would occur.
    
    Thus, the user asked me to recover as much as possible and then restructure 
    the drive if possible into working format again.
    
    No problem, mount under Windows 2000 access the drive, hmmn all seems fine 
    files arent corrupted.
    
    c:\>CHKDSK e:
    4,096 Bytes in Bad Sectors. Whoops, wheres that then..hmmn cant find those 
    sectors. CHKDSK e: /f didnt do anything either.
    
    Ok, so I cant find the clusters..[backspace] *cluster*. Never mind, ill tar 
    the directories and files on the FAT32 partition and GZIP them, MD% the file 
    wipe the HH and then restore the files.
    
    c:\>tar -cvf backup.tar e:\*
    c:\>gzip backup.tar
    c:\>md5sum backup.tar.gz
    
    Nice little batch file and an hour later, woohoo a 500MB tar/gzip archive 
    thatll fit nicely on a recovery CD.
    
    Come to expand the archive. The gzip program decompresses the original tar 
    archive. The tar program deflates into e:\ retaining the original stucture 
    of the paths etc. Nice, files expanding CPU usage 100%...(1.33GHz Athlon 
    lol).
    
    Oh. Huh? What the hell?
    
    c:\>e:
    e:\>ls
    My Documents
    Program Files
    autoexec.bat
    Bootlog.prv
    Bootlog.txt
    Command.com
    Config.sys
    Detlog.txt
    Frunlog.txt
    Io.sys
    Msdos.---
    Msdos.sys
    Netlog.txt
    
    Well thats sweet. What happened to the WINDOWS folder? What happened to the 
    other 20 directories and sub-directories of the project the guy was working 
    on? What happened to the other files in the root dir? AAAARRRHHHH!!!
    
    Ok, not to worry, i have my tarred and gzipped and md5 hashed archive burnt 
    to CD-R. Sweet, no sweat start again.
    
    Nope, same thing.
    
    Why doesnt the win32 port from unxutils of TAR tar up certain directories? 
    The TAR archive is just under the total filesize of the used 
    filespace..whats happened? Am i looking at an inability to cover archives 
    bigger than 600MB with these ports?
    
    Ive just landed myself and my guy in some trouble, but he dumped me in it 
    first I guess. :))
    
    Anyone have any ideas? Ive now labelled the disk damaged, so as to avoid 
    being used until its integrity can be futher confirmed.
    
    Thanks, and apologies for the length.
    
    Chris Mawer
    http://chrismawer.netfirms.com
    
    _________________________________________________________________
    Broadband? Dial-up? Get reliable MSN Internet Access. 
    http://resourcecenter.msn.com/access/plans/default.asp
    
    
    -----------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Fri Nov 08 2002 - 03:12:42 PST