On 01/30/2014 01:35 PM, Greg Freemyer wrote:
On Thu, Jan 30, 2014 at 1:23 PM, Anton Aylward
wrote: On 01/30/2014 01:12 PM, Greg Freemyer wrote:
A file carver, such as foremost, testdisk, photrec works by scanning all sectors looking for recognizable file headers.
Once they find that, they do a linear scan of the drive in an effort to find the end of the file. In many cases, they just guess.
What about a disk with a LVM partition? Suppose the partition table gets destroyed ... Isn't the information about the LVM 'portable' and well contained? Can't it say "There's the file system ..."
I don't think so.
If you set /dev/sda1 and /sdb2 to be the physical members of a LVM setup, then LVM maintains the location of the logical volumes it creates relative to the start of sda1 and sdb2.
If you lose your partition table, LVM will no longer know where sda1 and sdb2 are, so it's relative information is useless.
Now, recreating partition tables is not necessarily hard. I've used gpart a couple times to do that with great success.
Let me ask that a different way. I realise that LVM headers are text so they can be seen if do a 'strings' on the whole disk ... So they make the poster-boy here, but surely other file systems have clear headers as well. Isn't there a scanner/tool which can look for these and help you rebuild the partition table or whatever? Lets skip the case where the LVM is on multiple spindles, lets keep it simple, and lets skip the case where the whole disk is a LVM with no partition table. -- Warning: Klein Bottle. No user-serviceable parts inside. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org