From owner-freebsd-questions Mon Apr 26 13: 7:48 1999 Delivered-To: freebsd-questions@freebsd.org Received: from revolution.3-cities.com (revolution.3-cities.com [204.203.224.155]) by hub.freebsd.org (Postfix) with ESMTP id B7614150EF for ; Mon, 26 Apr 1999 13:07:44 -0700 (PDT) (envelope-from kstewart@3-cities.com) Received: from 3-cities.com (kenn1213.bossig.com [208.26.241.213]) by revolution.3-cities.com (8.8.5/8.7.3) with ESMTP id NAA23109; Mon, 26 Apr 1999 13:07:38 -0700 (PDT) Message-ID: <3724C63C.F81FA429@3-cities.com> Date: Mon, 26 Apr 1999 13:02:04 -0700 From: Kent Stewart Organization: Columbia Basin Virtual Community Project X-Mailer: Mozilla 4.51 [en] (WinNT; U) X-Accept-Language: en MIME-Version: 1.0 To: "Benjamin T. George" Cc: freebsd-questions@FreeBSD.ORG Subject: Re: Accessing Virus Infected (Boot Sector) HDD References: <3724CD47.794BDF32@thekeyboard.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Not likely. Your first MB is where FAT, directory, and boot information go. You can recover the boot but the FAT and directory are gone forever. Since not all of your files will be loaded in contiguous locations, the random offsets are gone forever. Kent "Benjamin T. George" wrote: > > Hello, > I just got my FreeBSD 3.1-R system up and running (with XFree86 and a > mail program and everything), and my Winblows 98 system got hit by the > Win95/CIH virus. (Luckily I have this system too, so I'm not without a > running computer :-). Anyway, the computer is a P5-120 (it's a few > years old) so it doesn't have a flash BIOS (luckily... since the virus > attempts to attack it and then you have bigger problems). So, the only > damage done, was the first megabyte of the disk drive was overwritten. > I don't have a backup of the drive because i just use it for home use, > and I wasn't expecting a virus (and I need some of the files off the > drive!). > So, *MY QUESTION IS*: can I put the hard drive in my FreeBSD machine, > and mount it as a DOS partition so I can retrieve the files a needed? > Remember, the first MB of the drive isn't there, so there's no boot > sector or anything available. > > PLEASE HELP! Thanks in advance. > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-questions" in the body of the message -- Kent Stewart Richland, WA mailto:kstewart@3-cities.com http://www.3-cities.com/~kstewart/index.html To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message