weyne/kaliwiki
1
0
Fork 0
mirror of https://github.com/mubix/kaliwiki.git synced 2025-10-29 16:59:26 +00:00
Code Issues Packages Projects Releases Wiki Activity
kaliwiki/tools/scrounge-ntfs.md
Stefan Molls 788305a83e Added forensics section
2014-04-23 10:38:32 -05:00

1.5 KiB
Raw Blame History

scrounge-ntfs

Notes

scrounge-ntfs is a utility that can rescue data from corrupted NTFS partitions. It writes the files retrieved to another working file system. Certain information about the partition needs to be known in advance.

The -l mode is meant to be run in advance of the data corruption, with the output stored away in a file. This allows scrounge-ntfs to recover data reliably. See the 'NOTES' section below for recover info when this isn't the case.

Help Text

usage: scrounge -l disk                                              
  List all drive partition information.                              
                                                                     
usage: scrounge -s disk                                              
  Search drive for NTFS partitions.                                  
                                                                     
usage: scrounge [-m mftoffset] [-c clustersize] [-o outdir] disk start end  
  Scrounge data from a partition                                     
  -m         Offset to mft (in sectors)                              
  -c         Cluster size (in sectors, default of 8)                 
  -o         Directory to put scrounged files in                     
  disk       The raw disk partitios (ie: /dev/hda)                   
  start      First sector of partition                               
  end        Last sector of partition

Example Usage

Links