Re: Problem with mounted vfat image

From: Paul Bakker <bakker(at)fox-it.com>
Date: Mon Apr 14 2003 - 04:20:51 EDT

I had the same problem with a "128 Mb USB Token Harddrive". Is this something like that?

As already told, you imaged a partition and not a hard drive. Therefore, fdisk will not give back any usefull information.

The garbled directories, were corrupted FAT entries in my case. Because somebody did not let (probably Windows) the OS flush its buffers, the partition probably got corrupted.

For the client I made a tarball of all the not corrupted folders. This requires quite some handwork to determine which directories were not corrupted and filter these out.

Paul Bakker

> -----Oorspronkelijk bericht-----
> Van: R Andersson [mailto:listbox@pole-position.org]
> Verzonden: vrijdag 4 april 2003 10:53
> Aan: forensics@securityfocus.com
> Onderwerp: Re: Problem with mounted vfat image
>
>
> Parth Galen wrote:

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Mon Apr 14 23:00:00 2003