Date: Mon, 26 Apr 1999 13:02:04 -0700 From: Kent Stewart <kstewart@3-cities.com> To: "Benjamin T. George" <beng@thekeyboard.com> Cc: freebsd-questions@FreeBSD.ORG Subject: Re: Accessing Virus Infected (Boot Sector) HDD Message-ID: <3724C63C.F81FA429@3-cities.com> References: <3724CD47.794BDF32@thekeyboard.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Not likely. Your first MB is where FAT, directory, and boot information go. You can recover the boot but the FAT and directory are gone forever. Since not all of your files will be loaded in contiguous locations, the random offsets are gone forever. Kent "Benjamin T. George" wrote: > > Hello, > I just got my FreeBSD 3.1-R system up and running (with XFree86 and a > mail program and everything), and my Winblows 98 system got hit by the > Win95/CIH virus. (Luckily I have this system too, so I'm not without a > running computer :-). Anyway, the computer is a P5-120 (it's a few > years old) so it doesn't have a flash BIOS (luckily... since the virus > attempts to attack it and then you have bigger problems). So, the only > damage done, was the first megabyte of the disk drive was overwritten. > I don't have a backup of the drive because i just use it for home use, > and I wasn't expecting a virus (and I need some of the files off the > drive!). > So, *MY QUESTION IS*: can I put the hard drive in my FreeBSD machine, > and mount it as a DOS partition so I can retrieve the files a needed? > Remember, the first MB of the drive isn't there, so there's no boot > sector or anything available. > > PLEASE HELP! Thanks in advance. > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-questions" in the body of the message -- Kent Stewart Richland, WA mailto:kstewart@3-cities.com http://www.3-cities.com/~kstewart/index.html To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3724C63C.F81FA429>