3 ms·
This is cool as a computer forensics exercise: the FS could look empty on one side but hide a lot of structured informing the other.
by gbin 7y ago
This is cool as a computer forensics exercise: the FS could look empty on one side but hide a lot of structured informing the other.
- AnIdiotOnTheNet 7y agoI have yet to meet any filesystem forensic software that wouldn't immediately identify this. Pretty much everything I've ever used would just tell you that it found multiple filesystems and show you both. Recovering files is often possible even without any filesystem metadata at all.
- JNRowe 7y agoTo make that point with an example, my go to for any new disk image or real drive is disktype¹ which produces: --- cursed.img Regular file, size 4 MiB (4194304 bytes) FAT12 file system (hints score 4 of 5) Volume size 3.916 MiB (4106240 bytes, 2005 clusters of 2 KiB) Ext2 file system UUID 2D74B033-E8A6-4738-98B2-02BCC3F0D98E (DCE, v4) Last mounted at "/home/kuba/cursedfs/mountpoint" Volume size 64 KiB (65536 bytes, 64 blocks of 1 KiB) 1. http://disktype.sf.net http://disktype.sf.net