Date: Tue, 14 Apr 2009 18:17:24 +0200 From: cpghost <cpghost@cordula.ws> To: freebsd-questions@freebsd.org Subject: Block device to regular file? Message-ID: <20090414161724.GA3721@phenom.cordula.ws>
next in thread | raw e-mail | index | archive | help
I'm trying to recover some deleted files from a UFS2 file system with the sleuthkit. Unfortunatly, most sleuthkit utilities expect regular image files and won't operate on block devices: phenom# fls /dev/ad4s1e Sector offset supplied is larger than disk image (maximum: 0) Of course, I could always dd(1) the block device into another file system, and analyze that: phenom# dd if=/dev/ad4s1e of=/mnt/ad4s1e.dd phenom# fls /mnt/ad4s1e.dd | more <regular-output-of-fls> but unfortunatly, the file system I'm trying to analyze is VERY large and I don't have enough disk space elsewhere to take an image. Now, is there an easy way to turn a block device into something that would behave like a regular file? Something like "mdconfig -t vnode", but in reverse? Thanks, -cpghost. -- Cordula's Web. http://www.cordula.ws/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20090414161724.GA3721>