I need a lil assistance with a image, I used DD to bitcopy a HD to one that was 3 gig bigger. I am using Knoppix and the patition tool it offers. I found on this drive the normal NTFS, and because it was a dell, the extra NTFS saved partiton, and the small swap partiton. however there is another partition that Knoppix shows a 2.5gb partiton that is unmountable, this partition will not show up under Encase but it will with ftk and knoppixstd
what should i do to make this partiton mountable under knoppix or ftk?
I have a sneaking suspicion this small partition holds information.
any help would be appreciated.
I know they(hp, dell) need the extra NTFS for restore.. I want to know what's on the 2.5GB partiton, it's a 4th partition besides the restore, normal and swap partitions. I was wondering if this is what they refer to as a "hidden" partiton and how I can mount it to view what's contained within.
Sorry if my earlier post was not clear. any help would be appreciated.
thanks
You need to find the boot sector for the partition, so you can determine the partition type. Encase is probably your best bet as it's going to interpret more file systems than FTK. When looking at the physical drive you should see the c and d partitions, and also "unused disk area". Thats where your lost partition is. The partition finder script should find it and allow you to rebuild it, if it is a supported type. If not you can search the space as you would unallocated space.
There may also be a linux solution, but I'll leave that to farmerdude.
TY, for the input. looking again into what encase shows.
Just out of curosity where in Virginia are you?
I'm on the southside near the NC line.
Just north of Roanoke, so not far at all