[ale] help with LDE [linux disk editor]

Greg Freemyer greg.freemyer at gmail.com
Sat Nov 25 19:40:13 EST 2006


Courtney,

I've never used LDE, but I suspect it works at the partition level not
the disk level.

If that is the case you need to try "lde /dev/hda1" to edit the first
primary partition on the disk.

"fdisk -l /dev/hda" will tell you what partitions you have to choose from.

If for some reason your partition table is destroyed, you may want to
look into gpart as a tool to recreate the partition table.

Hope that helps
Greg

On 11/25/06, Courtney Thomas <courtneycthomas at bellsouth.net> wrote:
> I'm tryin' to learn to use LDE and am experimenting with an old outta whack
> disk.
>
> When I...
>    lde /dev/hda
> the first screen comes up with an error screen, reporting....
>
>    root inode is not a dir
>    first block  (0) != normal first blk (1)
>    found ext2fs on device
>
>        inodes 252416
>        blocks 504000
>        firstdatazone 0 (N=1)
>        zonesize 4096
>        max size 1074791436
>
> 1-since root inode is not a dir, how do I convert it to a dir ?
>
> 2-what is the significance of the normal first block being 1 and this one's
> 0
>
> 3-what do you make of the numbers in the second block of data [5 lines] ?
>
> 4-by root inode, does LDE mean the superblock or block 1, I've assumed the
> superblock ?
>
> I hope that if I can resuscitate this disk, then when I run into real/active
> disk calamities,
> that I might be able to recover. Any suggestions for further information on
> use of this tool ?
>
> Thank you,
> Courtney
>
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://www.ale.org/mailman/listinfo/ale
>


-- 
Greg Freemyer
The Norcross Group
Forensics for the 21st Century



More information about the Ale mailing list