Hello,
I have a SimpleShare NAS hard drive that I need to pull some documents from. I made an image which I brought into EnCase., which sees it as unused disk space. I ran partition finder with no results.
By viewing unallocated space, I can see what appears to be a Unix/Linux file system (I see entries for SwapSpace and Unix like file paths)
There is an entry in what appears to be the MBR that states "Broadcom NAS version 1.1 MBR"
Is there anyway to manually rebuild these partitions, or any tools that would allow me to mount this?
Thanks!
Most NAS's are Linux-based and support one of the Linux file systems. The Simple Share could be extN where N is 2,3 or 4, Reiserfs, or one of the other file systems supported by Linux. Your best bet would be to make an image and copy it, and try mounting it in a Linux box using various options for the file system to the mount command. There are some utilities that will allow you to read Reiserfs and other Linux file systems in Windows.
EnCase (and other tools), may not have drivers for the file system, although you could try the newest FTK imager which supports a few that EnCase does not.
But, commonly, I find Linux to be the most versatile OS for analysis of retail NAS devices.
Its probably one of the EXT file systems. Have you tried going into disk view, going to physical sector 63 (or 2048), right clicking and adding a partition? Start with ext2 and 3 first, also have a look at the contents of those sectors for clues to the file system. Its not uncommon for encase to need a little help identifying the file system from time to time.
Sometimes the practical solution to NAS drives is a logical acquisition of the mapped network share which has pros and cons, but is another alternative.
Both excellent ideas. I will give them a try tomorrow and see what unfolds.
One such disk(s) I worked on recently was actually JBOD. The critical mapping information was stored in the second sector of each disk and then the data was Reiser 3 FS.
The example I saw (as in the link below) had three physical sections, on two drives, but logically it was a single partition. Any Ext2/3 partitions are normally just top run the Linux processor, and not part of the data storage.
http//
I had that problem with my NAS drive….It's actually contain 99% that are Linux Based File System.
http//
You can view, and get it from there….
http//
Try these….I used the second link..worked great for me…It just reads the Linux File System and you can get your files from there..