±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36317
New Yesterday: 0 Visitors: 171

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

recover vmdk file with foremost/scalpel help needed

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

piltrafa
Newbie
 

recover vmdk file with foremost/scalpel help needed

Post Posted: Oct 25, 08 21:40

Hi, I accidentally deleted a vmdk file (virtual disk) on an ext3 partition. I made an image of that partition to be sure not to write it again, and I'm trying to recover the file with foremost.
The problem that I have is that, because I don´t have the vmdk footer, it seems that foremost doesn't know where to stop carving, so it recreates the file up to the file max size configured on /etc/foremost.conf.
Maybe someone knows the footer of a vmdk file, or another procedure to let foremost know the end of a carved file.

Thanks and regards.  
 
  

ecophobia
Senior Member
 

Re: recover vmdk file with foremost/scalpel help needed

Post Posted: Oct 26, 08 11:04

May be it is easier in your case to use something like "Linux Ext2/Ext3 data recovery for Windows" free tool from Disk Internals?
Mount the image with MIP or SmartMount in Windows or if you have a writeblocker, use it to connect your hard drive and recover the deleted file this way.  
 
  

sanbarrow
Member
 

Re: recover vmdk file with foremost/scalpel help needed

Post Posted: Oct 27, 08 02:17

Maybe someone knows the footer of a vmdk file


What do you need - the first sector ?

Different types of vmdks have different first sectors ... which type are you looking for ?  
 

Page 1 of 1