5 Nov
2010
5 Nov
'10
11:24 a.m.
On 11/5/10 2:06 PM, Jason T wrote:
On Fri, Nov 5, 2010 at 11:45 AM, Dave
McGuire<mcguire at neurotica.com> wrote:
If I were doing it, I'd do some ASCII dumps at random offsets into
the image to try to guess what type of system it was from. If I spot
fragments of HP-UX startup messages and HP copyright notices, it's
likely I've found a block in the middle of a kernel for an HP
workstation, for example.
Then I'd go find the documentation for the filesystem layout in use,
and then try to figure out the next step in accessing it...be it fire up
a VMware guest (for x86 OSs) running that OS point it to that image and
mount it, or dig around in the garage for one of those systems,
configure it, load it up, squirt the image back to a scratch drive and
try to mount it, etc.
Getting the data to a "safe haven" is the first important thing to
accomplish when the continued operability of the drive in question is
suspect.
-Dave
--
Dave McGuire
Port Charlotte, FL
Preserving/snapshotting the contents of a SCSI
drive is as simple as
hooking it to a UNIX box and running a "dd" command.
For us n00bs, what's the next step? If it's a drive from a (for
example) SunOS box, you hook it up to a Solaris machine, mount it,
identify it as something you want, dd it and it is preserved.
What if you have (as I and probably most of you do) a pile of
completely unknown SCSI drives? So you hook it to your nearest *nix
machine, dd it to a file, and the drive is free to head crash and
become scrap. Now what do you do with that image?
I'd guess the next step is to try to mount that dd'd image somewhere.
Is there an easy way to ID the filesystem of a foreign drive, or is it
trial-and-error at that point?