Forensics
Mounting Sparc with Veritas enterprise admin service partitions / vxsvc Nov 10 2005 08:19AM
l1st3r gmx net (1 replies)
Hi

We have a Solaris Sparc fibre channel disk from a hacked machine with a strange partitioning scheme. It was part of a 2-disk RAID 1 mirror and was running vxsvc / Veritas enterprise administrator service before the disk was removed. I've got details of the mount points and partitions below. There was CMS data managed on a cluster on another machine, which we don't need to access. But we would like to get to the data that was on the disk itself (/local, /etc, and the root volume).

We are using a Sparc system to mount the disks (mount -o ro,noatime ...).

Can someone advise on how to mount these partitions?

Thanks for your help.

L.

VTOC Partition table (format output)

Part Tag Flag Cylinders Size Blocks
0 root wm 1 - 619 3.00GB (619/0/0) 6298944
1 swap wu 620 - 2679 10.00GB (2060/0/0) 20962560
2 backup wm 0 - 14086 68.35GB (14087/0/0) 143349312
3 - wu 0 - 0 4.97MB (1/0/0) 10176
4 - wu 1 - 14086 68.35GB (14086/0/0) 143339136
5 unassigned wm 0 0 (0/0/0) 0
6 var wm 13672 - 14084 2.00GB (413/0/0) 4202688
7 unassigned wm 0 0 (0/0/0) 0

Mount points (we are not able to mount /etc on this disk so this is from a system info file in the root directory):

Filesystem Mounted
/dev/vx/dsk/rootvol /
/proc /proc
fd /dev/fd
mnttab /etc/mnttab
/dev/vx/dsk/var /var
swap /var/run
swap /tmp
/dev/vx/dsk/local /local
/dev/vx/dsk/raiddg3/raid3vol /raid3
/dev/vx/dsk/raiddg4/raid4vol /raid4
/dev/vx/dsk/raiddg9/raid9vol /raid9

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus