Block device to regular file?

cpghost cpghost at cordula.ws
Tue Apr 14 16:17:28 UTC 2009


I'm trying to recover some deleted files from a UFS2 file
system with the sleuthkit. Unfortunatly, most sleuthkit
utilities expect regular image files and won't operate
on block devices:

  phenom# fls /dev/ad4s1e
  Sector offset supplied is larger than disk image (maximum: 0)

Of course, I could always dd(1) the block device into another
file system, and analyze that:

  phenom# dd if=/dev/ad4s1e of=/mnt/ad4s1e.dd
  phenom# fls /mnt/ad4s1e.dd | more
  <regular-output-of-fls>

but unfortunatly, the file system I'm trying to analyze
is VERY large and I don't have enough disk space elsewhere
to take an image.

Now, is there an easy way to turn a block device into
something that would behave like a regular file?
Something like "mdconfig -t vnode", but in reverse?

Thanks,
-cpghost.

-- 
Cordula's Web. http://www.cordula.ws/


More information about the freebsd-questions mailing list