5 Nov
2010
5 Nov
'10
12:08 p.m.
On 11/5/10, Jason T <silent700 at gmail.com> wrote:
On Fri, Nov 5, 2010 at 11:45 AM, Dave McGuire
<mcguire at neurotica.com> wrote:
Dump it, scan it, poke at it, etc.
Preserving/snapshotting the contents of a SCSI
drive is as simple as
hooking it to a UNIX box and running a "dd" command.
For us n00bs, what's the next step? If it's a drive from a (for
example) SunOS box, you hook it up to a Solaris machine, mount it,
identify it as something you want, dd it and it is preserved.
What if you have (as I and probably most of you do) a pile of
completely unknown SCSI drives? So you hook it to your nearest *nix
machine, dd it to a file, and the drive is free to head crash and
become scrap. Now what do you do with that image? I'd guess the next step is to try to mount that
dd'd image somewhere.
Is there an easy way to ID the filesystem of a foreign drive, or is it
trial-and-error at that point?
There's some guided trial-and-error needed, most likely. If it truly
is an "unknown" filesystem, there are two tools I'd start with to
investigate what the image is about...
'od' (octal dump) and 'strings' (search binary images for sequences of
printable ASCII)
Between the two tools, you can do a lot to wade through raw piles of
disk blocks, and if you use 'dd' as a scalpel (to carve out sections
to dump that start at exactly byte XXXX and are exactly YYYY blocks
long), it's even convenient to follow filesystem structures to help
confirm your earlier suspicions about what sort of filesystem it
really is.
Some environments are more flexible than others. Linux supports many
recent filesystem types, but I wouldn't want to try to dig through a
Solaris disk on a VMS machine. Once I knew what the filesystem of my
image was, I'd see if I had a compatible machine, either real or
virtual, to at least be able to browse the filesystem at a file level.
For me, sometimes that's real hardware, sometimes that's simh,
sometimes it's something else. It all depends on what I find (in my
house, odds are a hard disk or floppy image is going to be AmigaDOS
(FFS or OFS), MacOS (HFS), DOS/Windows (FAT or NTFS), RT-11, OS/8,
CP/M, TRSDOS, VMS (ODS-1), SunOS 4, Solaris, Linux (ext2 or ext3), or
perhaps some flavor of BSD - I'm sure others here have greater a
lesser chances for those and more).
-ethan