User:Laurier Rochon/bbb/hhd forensics: Difference between revisions

Revision as of 22:12, 11 November 2010

Install foremost
Check dmesg for info on the newly connected drive (dmesg | tail to get only recent logs)
Cat /proc/partitions (sdbs' is the one we want - not 'sda', that's our own drive)
sudo foremost -v -T -o /tmp/report -i /dev/sdb5 (replace sdb5 with drive...)
install gqview to view broken files

Pipe the contents of HD to mplayer

cat /proc/partitions (see all your HD partitions)
HDD to audio : sudo dd if=/dev/sd3 skip=50000 | aplay -
HDD to video : sudo gst-launch-0.10 filesrc location=/dev/sda3 ! videoparse ! xvimagesink

@@ Line 2: / Line 2: @@
-- foremost
+*foremost
-- scalpel
+*scalpel
 http://moddr.net/wiki/doku.php?id=data_carving_workshop (infos)
-http://www.moddr.net/wp-content/datacarving_cheatsheet.png (cheat sheet)
+(cheat sheet on there)
-- Install foremost
+*Install foremost
-- Check dmesg for info on the newly connected drive (dmesg | tail to get only recent logs)
+*Check dmesg for info on the newly connected drive (dmesg | tail to get only recent logs)
-- Cat /proc/partitions (sdbs' is the one we want - not 'sda', that's our own drive)
+*Cat /proc/partitions (sdbs' is the one we want - not 'sda', that's our own drive)
-- sudo foremost -v -T -o /tmp/report -i /dev/sdb5 (replace sdb5 with drive...)
+*sudo foremost -v -T -o /tmp/report -i /dev/sdb5 (replace sdb5 with drive...)
-- install gqview to view broken files
+*install gqview to view broken files
-Pipe the contents of HD to mplayer
+'''Pipe the contents of HD to mplayer'''
-cat /proc/partitions (see all your HD partitions)
+*cat /proc/partitions (see all your HD partitions)
+*HDD to audio : sudo dd if=/dev/sd3 skip=50000 | aplay -
-HDD to audio : sudo dd if=/dev/sd3 skip=50000 | aplay -
+*HDD to video : sudo gst-launch-0.10 filesrc location=/dev/sda3 ! videoparse ! xvimagesink
-HDD to video : sudo gst-launch-0.10 filesrc location=/dev/sda3 ! videoparse ! xvimagesink