What is the MFT equivalent in a Linux partition?

Data recovery from Hard Disk Drives with logical problems

Moderator: Dmitriy_TS


osity
User
Posts: 358
Joined: 06.12.15
Reputation: 4 / (38)

What is the MFT equivalent in a Linux partition?

Postby osity » 29.11.18, 19:35

On an NTFS recovery, I normally look for the MFT first, and make sure that I image it completely so I know that I have a complete directory listing displayed.
What is the equivalent item in the EXT file systems?

Currently, I'm working on a case which displays the EXT files system fine, but how can I verify the 'completeness' of it, like I do with an MFT File or Catalog File?

User avatar
DataMedics
Advanced user
Posts: 579
Joined: 15.12.15
Reputation: 16 / (163)

Re: What is the MFT equivalent in a Linux partition?

Postby DataMedics » 30.11.18, 01:24

With EXT it's spread out all over the drive. You could do a snapshot of the filesystem to be sure to read all of the inodes. Or you could just select all the files in the root and map them (in the process of doing that it'd have to identify each file) but it'd take a long time and be stressful on the drive doing all that bouncing around reading from beginning to end.

You're really better off just imaging by bitmap and forget about it.


osity
User
Posts: 358
Joined: 06.12.15
Reputation: 4 / (38)

Re: What is the MFT equivalent in a Linux partition?

Postby osity » 30.11.18, 03:12

I was having trouble expanding a VAR folder, so I thought something was missing but after I scanned the LVM2 metadata, and refreshed the root folder, voila, I have a VAR directory.

Thanks for the help.


Return to “Data Extractor”

Who is online

Users browsing this forum: No registered users and 1 guest