Friday, January 28, 2011

ext3 data hidden in ntfs format... how to recover?

i have a TB hard disk, owner say "i stored data that were in EXT3 format and make some changes in structure of hard disk for security reasons, you will see a NTFS partition on this disk, but you should 'mount -f -t ext3.....' this partition in backtrack to see the main data" when i do this... i see nothing on the mount point!! any suggestion???

  • You need to

    1. Find out exactly what change they made were
    2. Found out whether they can actually mount it
    3. Teach them that security through obscurity doesn't work and in cases like this causes more trouble than it's worth.
    From Cry Havok
  • You might have some luck with a tool like testdisk or some other file system recovery tool. You might also want to try file level recovery

0 comments:

Post a Comment