On Fri, 8 Feb 2008, Robin - Bartow FL wrote:
> ----- Original Message -----
> From: Eben King eben01@verizon.net
> To: SLUG Mailing List slug@nks.net
> Sent: 2/3/08 4:41 PM
> Subject: [SLUG] mystery file
>
>> So I've got this file:
>>
>> -r-------- 1 root root 116G Feb 21 2007 /mnt/temp2/hda
>>
>> (BTW, /mnt/temp2 is itself a mounted partition on a USB drive.)
>>
>> So far I've done this:
>>
>> root@pc:~# losetup /dev/loop2 /mnt/temp2/hda
>> root@pc:~# fdisk -l /dev/loop2
>>
>> Disk /dev/loop2: 123.5 GB, 123522416640 bytes
>> 255 heads, 63 sectors/track, 15017 cylinders
>> Units = cylinders of 16065 * 512 = 8225280 bytes
>>
>> Device Boot Start End Blocks Id System
>> /dev/loop2p1 * 1 5135 41246856 7 HPFS/NTFS
>> /dev/loop2p2 5136 15017 79377165 7 HPFS/NTFS
>>
>> OK, how do I mount them (read-only is fine, I just want to see what's
>> there)?
>
> This process has jogged my memory in the past and may help you.
>
> 1. Do a search for all files with the same day, date stamp.
> 2. Sort the results by Year-Month-Day-Hour-Minute-Second
> 3. Study the files + or - 5 minutes to the file in question.
comp.os.linux.hardware gave me the solution:
fdisk -il /dev/loop2
that'll give me the sector numbers of the partition starts and ends. Then I
take the partition start, multiply by the sector size (512 on HDs), pass
that as an option to
mount ... -o offset=xxx
and there I go. Yep, it was what I thought it was.
-- -eben QebWenE01R@vTerYizUonI.nOetP royalty.mine.nu:81 A. A Top Poster \ http://www.fscked.co.uk/ B. Who's there? \ writing/ A. Knock-knock -- from bobward@xxx.com \ top-posting-cuss.html ----------------------------------------------------------------------- This list is provided as an unmoderated internet service by Networked Knowledge Systems (NKS). Views and opinions expressed in messages posted are those of the author and do not necessarily reflect the official policy or position of NKS or any of its employees.
This archive was generated by hypermail 2.1.3 : Fri Aug 01 2014 - 14:59:17 EDT