Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 14 Apr 2009 18:17:24 +0200
From:      cpghost <cpghost@cordula.ws>
To:        freebsd-questions@freebsd.org
Subject:   Block device to regular file?
Message-ID:  <20090414161724.GA3721@phenom.cordula.ws>

next in thread | raw e-mail | index | archive | help
I'm trying to recover some deleted files from a UFS2 file
system with the sleuthkit. Unfortunatly, most sleuthkit
utilities expect regular image files and won't operate
on block devices:

  phenom# fls /dev/ad4s1e
  Sector offset supplied is larger than disk image (maximum: 0)

Of course, I could always dd(1) the block device into another
file system, and analyze that:

  phenom# dd if=/dev/ad4s1e of=/mnt/ad4s1e.dd
  phenom# fls /mnt/ad4s1e.dd | more
  <regular-output-of-fls>

but unfortunatly, the file system I'm trying to analyze
is VERY large and I don't have enough disk space elsewhere
to take an image.

Now, is there an easy way to turn a block device into
something that would behave like a regular file?
Something like "mdconfig -t vnode", but in reverse?

Thanks,
-cpghost.

-- 
Cordula's Web. http://www.cordula.ws/



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20090414161724.GA3721>