Try a bootable CD like Knoppix (http://www.knoppix.net/ )or Bart PE
(http://www.nu2.nu/pebuilder/ ). Both of these CDs allow viewing of the
files on the disk, etc, without the aid (or interference) of the normal OS.
Note:I work in a corporate environment for internal use only, not sure if
these are acceptable in court and such.
Mike
________________________________
Michael Parkhurst
IT Manager
SAMSys Technologies, Inc.
2525 Meridian Parkway, Lake Level Suite 60
Durham, North Carolina 27713
Office: 919-281-1563 / Fax: 919-281-1551 / http://www.samsys.com/
________________________________
The information in this e-mail and any attachments are confidential and may
also be legally privileged. If you are not the intended recipient, you are
hereby notified that you have received this communication in error and that
any review, dissemination or copying of this message is strictly prohibited.
If you have received this communication in error, please notify us
immediately by telephone and delete the communication.
-----Original Message-----
From: Bénoni MARTIN [mailto:Benoni.MARTIN@libertis.ga]
Sent: Monday, September 19, 2005 10:17 AM
To: forensics@securityfocus.com
Subject: HDA unreadable & NTFS partition with fatal errors ?
Hi list !
I'm currently doing auditing a hacked server (Win 2K3 SP 1) and something
odd happends on a partition with dada (D:):
- Under Win 2K3 (after booting with it), the partition is visible and found
as "free space", but no way to create a partition on it (fatal error occurs
during the task).
- Under Win 2K3 (with the recuperation console), the partition is visible as
"D:", but no way either to check the volume with chkdsk, chkntfs ot any
command like that.
- As there ware some free space on the hard disk (another than the D:
partition), I tried to set up a Fedora Core 4 on it, but failed when tried
to install it with Druid: "HDA is not readeable"
I did not tried to format the D: partition as I want first to try to get the
data on it to try to understand what happened.
Anyone has an idea of how can I make the partition be readable again without
formatting it (what can I do if booting under another OS, or is there a
useful tool for recovering data on unreadable partition) ? I have obviously
full access to the box, but I am really at a loss for an idea to access trhe
partition :(
Any help will be appreciated, I'm quite stuck with this :(
Thx !
