Skip to content

Instantly share code, notes, and snippets.

@joshenders
Created August 31, 2011 10:24
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save joshenders/1183253 to your computer and use it in GitHub Desktop.
Save joshenders/1183253 to your computer and use it in GitHub Desktop.
NTFS partition scanner
#!/bin/bash
start=1048576 # decimal offset of data on drive (past MBR, 1MB)
end=10485760 # decimal offset of data on drive (well past weird '...U...N.b..' structures, 10MB)
image=/mnt/seagate/wd_backup.img
mount=/mnt/wd
for ((offset=$start; offset<=$end; offset++)); do
echo "trying offset: $offset"
status="$(mount -o ro,offset=$offset,loop -t ntfs $image $mount >/dev/null 2>&1; echo $?)"
if [[ "$status" -ne '32' ]]; then
echo "$image may have mounted successfully at offset: $offset"
exit 0
fi
done
echo "Search space $start - $end exhausted"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment