Hi folks,
I am in the middle of a forensics gig on a netware 5.0 box. We know the strings of the document we are searching for.
We have been able to use strsch (fast test string search - 4GB in 30 mins) from and salvslist from JRBuitls to search the active files and determine that there about 750,000 deleted files still on one of the volumes.
We are planning to use portlock storage manager to image the drive prior to doing a salvage on the deleted files and directories as to not mess up the volumes with old data.
The target box is a compaq proliat1 1900 with a logical hardware raid (5?) spanning 3 9 gig phyiscal SCSI drive seen as a C: drive on boot with sys and vol1 netware partions.
On a tesbox with an adapted RAID (mirror) We cabled up an 8OGB IDE drive, fdisked and formated in dos 6.22. We can see C: and D: in Caldera DR-DOS boot.
In NWCONFIG - I seem unable to see the new drive in order to
create a netware volume or partion on the new drive. I recall an issue many moons ago with IDE drivers and I think it was NW 4.11.
Any thoughts, directions?
Regards,
David R. Hibbeln
email: drh hibbeln net (fill in the spaces)
I am in the middle of a forensics gig on a netware 5.0 box. We know the strings of the document we are searching for.
We have been able to use strsch (fast test string search - 4GB in 30 mins) from and salvslist from JRBuitls to search the active files and determine that there about 750,000 deleted files still on one of the volumes.
We are planning to use portlock storage manager to image the drive prior to doing a salvage on the deleted files and directories as to not mess up the volumes with old data.
The target box is a compaq proliat1 1900 with a logical hardware raid (5?) spanning 3 9 gig phyiscal SCSI drive seen as a C: drive on boot with sys and vol1 netware partions.
On a tesbox with an adapted RAID (mirror) We cabled up an 8OGB IDE drive, fdisked and formated in dos 6.22. We can see C: and D: in Caldera DR-DOS boot.
In NWCONFIG - I seem unable to see the new drive in order to
create a netware volume or partion on the new drive. I recall an issue many moons ago with IDE drivers and I think it was NW 4.11.
Any thoughts, directions?
Regards,
David R. Hibbeln
email: drh hibbeln net (fill in the spaces)