Geoffrey, This is pretty much what I have recently found out with a WinXP 30 gig image. I was able to see all of the files by installing the NTFS driver from NTFS driver project found at http://linux-ntfs.sourceforge.net. I am not sure if gentoo uses this driver or not. The Redhat kernel still uses the old one. However, I still cannot recover any files. I remember the last time I installed Task there were a bunch of filesystem files. I am not sure if Brian has updated Task to support NTFS 3.0. > /usr/local/task/bin/fls: entry 29286 has an invalid MFT magic: 88000000 I have been receiving similar errors using Task when clicking on deleted files. Also, I can recover file using Task. In order to recover any files I had to load up vmware running Windows 2000 and use Restorer2000 on the dd image. Keven Murphy GCIA & GCFA murphykat_private ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Mon Nov 18 2002 - 19:47:29 PST