----- Original Message -----
From: Eben King eben01@verizon.net
To: SLUG Mailing List slug@nks.net
Sent: 2/3/08 4:41 PM
Subject: [SLUG] mystery file
> So I've got this file:
>
> -r-------- 1 root root 116G Feb 21 2007 /mnt/temp2/hda
>
> (BTW, /mnt/temp2 is itself a mounted partition on a USB drive.)
>
> So far I've done this:
>
> root@pc:~# losetup /dev/loop2 /mnt/temp2/hda
> root@pc:~# fdisk -l /dev/loop2
>
> Disk /dev/loop2: 123.5 GB, 123522416640 bytes
> 255 heads, 63 sectors/track, 15017 cylinders
> Units = cylinders of 16065 * 512 = 8225280 bytes
>
> Device Boot Start End Blocks Id System
> /dev/loop2p1 * 1 5135 41246856 7 HPFS/NTFS
> /dev/loop2p2 5136 15017 79377165 7 HPFS/NTFS
>
> OK, how do I mount them (read-only is fine, I just want to see what's
> there)? Probably it's merely a CYA backup before I resized the partitions.
>
> I have a feeling it's something akin to
>
> root@pc:~# mount /dev/loop2 /mnt/temp3 -t ntfs -o ro,offset=8225280
>
> but I don't know what the offset should be. If I can get rid of that file,
> it would free up >100 GB.
>
> --
> -eben QebWenE01R@vTerYizUonI.nOetP royalty.mine.nu:81
> LIBRA: A big promotion is just around the corner for someone
> much more talented than you. Laughter is the very best medicine,
> remember that when your appendix bursts next week. -- Weird Al
> -----------------------------------------------------------------------
This process has jogged my memory in the past and may help you.
1. Do a search for all files with the same day, date stamp.
2. Sort the results by Year-Month-Day-Hour-Minute-Second
3. Study the files + or - 5 minutes to the file in question.
-----------------------------------------------------------------------
This list is provided as an unmoderated internet service by Networked
Knowledge Systems (NKS). Views and opinions expressed in messages
posted are those of the author and do not necessarily reflect the
official policy or position of NKS or any of its employees.
This archive was generated by hypermail 2.1.3 : Fri Aug 01 2014 - 14:59:05 EDT