[TriLUG] Lost Partition Table!

[rpjday]

On Sat, 8 Sep 2001, Sinner from the Prairy wrote:

> If you can make it work, I wil be very grateful. Heck, I'll buy you a beer!

here's the general idea, encapsulated in a Perl program:

------------------

#!/usr/bin/perl

(@ARGV == 1)		or die "Need disk device" ;

open(DSK, $ARGV[0])	or die "Can't open $ARGV[0]" ;

$offset = 0 ;
while (read(DSK, $sector, 512)) {
	if(substr($sector, -2, 2) eq "\x55\xaa") {
		print "Found boot sector at offset $offset.\n" ;
	}
	$offset += 512 ;
}

------------------

  what this does is accept a drive device file (e.g., /dev/hda) as
an argument, open it for reading (clearly, this program must be run
as root), and scans for boot sectors, a boot sector being identified
by the trailing hex "55aa" signature in the last two bytes.

  obviously, this has the potential to give you *lots* of false
positives, but it should be easy to see the philosophy.  now, all
i have to do is look at the include files for the different file-
systems and extract what appear to be unique byte patterns which
identify the beginning of those filesystems.

  unless someone out there can already tell me that ...

rday