I'm trying to recover some deleted files from a UFS2 file system with the sleuthkit. Unfortunatly, most sleuthkit utilities expect regular image files and won't operate on block devices:
phenom# fls /dev/ad4s1e Sector offset supplied is larger than disk image (maximum: 0) Of course, I could always dd(1) the block device into another file system, and analyze that: phenom# dd if=/dev/ad4s1e of=/mnt/ad4s1e.dd phenom# fls /mnt/ad4s1e.dd | more <regular-output-of-fls> but unfortunatly, the file system I'm trying to analyze is VERY large and I don't have enough disk space elsewhere to take an image. Now, is there an easy way to turn a block device into something that would behave like a regular file? Something like "mdconfig -t vnode", but in reverse? Thanks, -cpghost. -- Cordula's Web. http://www.cordula.ws/ _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[email protected]"
