I almost forgot. Check out this link, too, while you at it: it has a
bunch of caveats and warnings, with a lot of user experiences with the
rebuild process:

http://www.antrix.net/journal/techtalk/reiserfs_data_recovery_howto.comm
ents

-Ryan

Steve Bonds wrote:

>On 12/29/05, I wrote:
>
>
>>Does anyone know of a linux-based tool that works with Reiserfs
>>Version 3? Normally I would use The Sleuth Kit/Autopsy, however it
>>doesn't appear that they support Reiserfs V3.
>>
>>
>
>... trimmed ...
>
>
>
>>Anyone have a suggestion?
>>
>>
>
>Here's some more information based on some of the non-automated E-mail
>I received asking for more info/clarification.
>
>I have a damaged hard drive containing a reiserfs filesystem. I've
>managed to create the best image I can of the drive using dd_rescue
>and Helix. The image has some "holes" filled in with zeroes where the
>drive was unreadable.
>
>Right now I'm just trying for a simple data recovery to see what
>"obvious" things are on the drive. This will help determine if more
>analysis is needed. I have no reason (yet) to suspect that a
>deliberate attempt to hide any files has taken place.
>
>Since I can't find a tool to read the reiserfs portion of the image I
>plan to "dd" out the reiserfs partition based on disk-block offsets to
>another image and use reiserfsck in an attempt to make it loop-device
>mount-able under linux. There is a good chance this will result in
>lost data/missing files but I'm being careful to preserve the original
>image in case more analysis is needed.
>
>Later on I may need to examine deleted files, slack space, and other
>areas of the image that may not be displayed via a normal "mount".
>For this, something like The Sleuth Kit would almost assuredly be
>needed. I thought I might as well start looking now rather than when
>things become more time-sensitive. (However at that time my budget
>may go up, too! ;-)
>
>I've had at least one recommendation for X-Ways, however it seems like
>there should be some Linux-based software to help with this.
>
>Anyone know of any? It's beginning to look like it's either X-Ways or
>Encase, neither of which are currently in budget.
>
>Thanks,
>
> -- Steve
>
>
>

[ reply ]