Block device to regular file?
cpghost
cpghost at cordula.ws
Tue Apr 14 16:17:28 UTC 2009
I'm trying to recover some deleted files from a UFS2 file
system with the sleuthkit. Unfortunatly, most sleuthkit
utilities expect regular image files and won't operate
on block devices:
phenom# fls /dev/ad4s1e
Sector offset supplied is larger than disk image (maximum: 0)
Of course, I could always dd(1) the block device into another
file system, and analyze that:
phenom# dd if=/dev/ad4s1e of=/mnt/ad4s1e.dd
phenom# fls /mnt/ad4s1e.dd | more
<regular-output-of-fls>
but unfortunatly, the file system I'm trying to analyze
is VERY large and I don't have enough disk space elsewhere
to take an image.
Now, is there an easy way to turn a block device into
something that would behave like a regular file?
Something like "mdconfig -t vnode", but in reverse?
Thanks,
-cpghost.
--
Cordula's Web. http://www.cordula.ws/
More information about the freebsd-questions
mailing list