Hi, I accidentally deleted a vmdk file (virtual disk) on an ext3 partition. I made an image of that partition to be sure not to write it again, and I'm trying to recover the file with foremost.
The problem that I have is that, because I don´t have the vmdk footer, it seems that foremost doesn't know where to stop carving, so it recreates the file up to the file max size configured on /etc/foremost.conf.
Maybe someone knows the footer of a vmdk file, or another procedure to let foremost know the end of a carved file.
Thanks and regards.
May be it is easier in your case to use something like "
Mount the image with MIP or SmartMount in Windows or if you have a writeblocker, use it to connect your hard drive and recover the deleted file this way.
Maybe someone knows the footer of a vmdk file
What do you need - the first sector ?
Different types of vmdks have different first sectors … which type are you looking for ?