±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36783
New Yesterday: 2 Visitors: 153

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

mounting extended partition

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

farrahyde
Member
 

mounting extended partition

Post Posted: Feb 27, 06 07:49

I need a lil assistance with a image, I used DD to bitcopy a HD to one that was 3 gig bigger. I am using Knoppix and the patition tool it offers. I found on this drive the normal NTFS, and because it was a dell, the extra NTFS saved partiton, and the small swap partiton. however there is another partition that Knoppix shows a 2.5gb partiton that is unmountable, this partition will not show up under Encase but it will with ftk and knoppixstd
what should i do to make this partiton mountable under knoppix or ftk?
I have a sneaking suspicion this small partition holds information.
any help would be appreciated.
_________________
If you're gonna do it, do it well, or not at all. 
 
  

debaser_
Senior Member
 

Re: mounting extended partition

Post Posted: Feb 27, 06 09:59

The extra NTFS partition on Dells and HPs is used for system restore. It cant have the image data on the primary partition and restore to itself.  
 
  

farrahyde
Member
 

Re: mounting extended partition

Post Posted: Feb 27, 06 18:57

I know they(hp, dell) need the extra NTFS for restore.. I want to know what's on the 2.5GB partiton, it's a 4th partition besides the restore, normal and swap partitions. I was wondering if this is what they refer to as a "hidden" partiton and how I can mount it to view what's contained within.
Sorry if my earlier post was not clear. any help would be appreciated.
thanks
_________________
If you're gonna do it, do it well, or not at all. 
 
  

gmarshall139
Senior Member
 

Re: mounting extended partition

Post Posted: Feb 27, 06 19:28

You need to find the boot sector for the partition, so you can determine the partition type. Encase is probably your best bet as it's going to interpret more file systems than FTK. When looking at the physical drive you should see the c and d partitions, and also "unused disk area". Thats where your lost partition is. The partition finder script should find it and allow you to rebuild it, if it is a supported type. If not you can search the space as you would unallocated space.

There may also be a linux solution, but I'll leave that to farmerdude.
_________________
Greg Marshall, EnCE 
 
  

farrahyde
Member
 

Re: mounting extended partition

Post Posted: Feb 27, 06 19:48

TY, for the input. looking again into what encase shows.
Just out of curosity where in Virginia are you?
I'm on the southside near the NC line.
_________________
If you're gonna do it, do it well, or not at all. 
 
  

gmarshall139
Senior Member
 

Re: mounting extended partition

Post Posted: Feb 27, 06 20:00

Just north of Roanoke, so not far at all
_________________
Greg Marshall, EnCE 
 

Page 1 of 1