Re: Destroying filesystems

--- Richard Bond <rbond@gs.washington.edu> wrote:
> Or change the partition type,  Boot a linux cd

As I was saying, I'd like to do this from within the
system, not by booting something else (it's going to
be a forensic exercise for my class and I want to keep
it as real as possible, to have an application run in
unattended mode, do its thing and then ask the
students to reboot their machines, swap places - and
face the facts :-) Changing the partition type is a
good idea (to make the exercise yet more difficult),
but what I'd like to get would be an (unknown) file
system, with little or damaged logical organization on
disk, so the students would have to:

a) identify the correct filesystem;
b) try and repair the filesystem with specific tools
(important!);
c) recover data (quite redundant - if they manage to
recover the filesystem, it's obvious that they will be
able to read/write anything).

The purpose of this exercise would also be recovering
filesystems, not just looking for a specific file or
file type with a hex editor, reading data in raw mode.


                
__________________________________ 
Do you Yahoo!? 
Yahoo! Personals - Better first dates. More second dates. 
http://personals.yahoo.com


-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com