From owner-freebsd-questions Wed May 13 00:11:26 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id AAA27277 for freebsd-questions-outgoing; Wed, 13 May 1998 00:11:26 -0700 (PDT) (envelope-from owner-freebsd-questions@FreeBSD.ORG) Received: from alpo.whistle.com (alpo.whistle.com [207.76.204.38]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id AAA27218 for ; Wed, 13 May 1998 00:11:12 -0700 (PDT) (envelope-from julian@whistle.com) Received: (from daemon@localhost) by alpo.whistle.com (8.8.5/8.8.5) id AAA11520; Wed, 13 May 1998 00:06:45 -0700 (PDT) Received: from current1.whistle.com(207.76.205.22) via SMTP by alpo.whistle.com, id smtpd011517; Wed May 13 07:06:35 1998 Date: Wed, 13 May 1998 00:06:32 -0700 (PDT) From: Julian Elischer To: Chris Conner cc: freebsd-questions@FreeBSD.ORG Subject: Re: Last sector of partitions set to 0 In-Reply-To: <3.0.32.19980513010823.006c1c78@nirvana.net> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG last sector of each partition???? how did you decide this? was it in a file? sounds decidedly wierd. there are often unallocated blocks at the end of each partition.. julian On Wed, 13 May 1998, Chris Conner wrote: > Hello, > > Recently one of our FreeBSD machines was compromised. We do know that the > last sector of each partition was set to zero. Is it at all possible to > recover the data on this drive, by somehow restoring the partition table? > Even if we could just get it back temporarily, to recover some things, it > would be a great help. We are almost sure of the exact partition table, but > we don't want to risk losing any data by messing around with anything, > before consulting you guys. > > Any help would be greatly appreciated, > > Chris Conner > chris@nirvana.net > 609-588-0078 > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-questions" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message