De : Nick Puetz <nickpuetz@yahoo.com>
Date : Thu, 30 Sep 2004 13:42:58 +0200
À : forensics@securityfocus.com
Objet : Hard disk file system identification
Hello,
I have received an internal hard drive that I need to image and perform
some analysis on; however, I don't know the file system type on the
disk, there for, I can not correctly mount it to the RedHat 9 machine I
used to do my image creation and analysis. Is there any way that I can
identify what file system type is on a hard disk without jeopardizing
the integrity of the hard disk? Thanks for the help.
Nick
If you have a dd raw image file you can do a 'fdisk -lu yourimage.raw'. This
will tell you the partition scheme and also the filesystems involved. Do not
forget to tell the offset to mount. Here is an example :
Consider that we have done a dd raw image of a disque and that we named it
"maxtor-A21S6LTC."
'fdisk -lu maxtor-A21S6LTC' leads to
Disque maxtor-A21S6LTC : 255 têtes, 63 secteurs, 0 cylindres
Unités = secteurs sur 1 * 512 octets
Périphérique Amorce Début Fin Blocs Id Système
maxtor-A21S6LTC1 * 63 8177084 4088511 b Win95 FAT32
maxtor-A21S6LTC2 8177085 8418059 120487+ 16 FAT16 caché
This is a localised french output ! So we have 2 partitions : one vfat32 and
one hidden fat16.
Now we can mount those partitions with the following commands :
'mount maxtor-A21S6LTC /mnt/part1 -o ro,loop,offset=32256,umask=222 -t vfat'
'mount maxtor-A21S6LTC /mnt/part2 -o ro,loop,offset=4186667520,umask=222 -t
vfat'
Please be sure to use the 2.12b version of the util-linux package as
offsets are 64 bits in that version (31 bits in the previous versions). You
can find the source on the kernel.org site in /pub/linux/utils/util-linux
Hope this helps.
--
Olivier DELHOMME
Engineer
Head of the Forensic Computer Laboratory
DCPJ / SDPTS / SITT / LATS
Tel +33 (0) 4.72.86.84.60
Fax +33 (0) 4.72.86.85.24
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
