Re: 2 data recovery questions

From: Brian C. Lane (bclat_private)
Date: Mon Nov 11 2002 - 07:30:52 PST

  • Next message: Bruce P. Burrell: "Re: Win32 Port of TAR"

    On Sun, Nov 10, 2002 at 10:39:24AM -0600, Rod Hauser wrote:
    > I have 2 data recovery situations that could use an opinion.
    > 
    > 1) a 100GB+ scsi disk from an SGI that has data on it, but nothing is 
    > visible. I'd prefer either a professional but affordable service 
    > recommendation, or a freely downloadable toolkit, preferably Linux, but I do 
    > have another SGI I could load it on, too. 
    > I've downloaded the PLAC toolkit iso, but haven't tried it yet.
    > Any other recommendations?
    
      Just a WAG on this one, I think the current Linux distributions support
    SGI filesystems. I think I've seen the option in the kernel configuration
    list.
    
    
    > 2) a 3.3V 64MB SmartMedia card that was filled up in the camera, but now
    > shows as blank (errors) both in the camera and in the FlashPath floppy
    > adapter.  . I downloaded a piece of software that said it might read it, but
    > it doesn't show any more data.  I've considered buying a USB adapter just to
    > try recovery one more way, but I do not have high hopes.
    > Any opinions to the contrary?
    
    I have done this with Windows 98 and MMC cards using some disk imaging
    tools and an older SanDisk MMC reader (the newest ones are buggy and
    sometimes don't work well). You should be able to do the same thing with
    SmartMedia. I don't have the names of the programs here at home, I'll snag
    them from work today and post them.
    
    The first thing to do is to make an image of the device, make several copies
    of the image <G>, and then work on them. Alot of the time the data is still
    there, but the directory entries are either deleted (simple to recover from)
    or messed up by some other means.
    
    With embedded devices like cameras usually the files will be written to a
    clean device so the data will be contiguous. If you can find the start
    and end of the files (looking for the jpeg start header is one way) you can
    then dump just that data from the image to a file and see if an image viewer
    will display it.
    
    This is similar to how I solved the latest Honeynet scan (floppy with
    deleted files).
    
    Brian
    
    -- 
    Linux Consulting and Software Development
    http://www.brianlane.com
    DigiTemp --[Inside 69.9F]--[Outside 48.2F]--[fozzy 68.9F]--[Drink 74.0F]--
    
    
    



    This archive was generated by hypermail 2b30 : Mon Nov 11 2002 - 10:34:11 PST