View Single Post
Old 06-15-2012, 08:38 AM   #3
knc1
Going Viral
knc1 ought to be getting tired of karma fortunes by now.knc1 ought to be getting tired of karma fortunes by now.knc1 ought to be getting tired of karma fortunes by now.knc1 ought to be getting tired of karma fortunes by now.knc1 ought to be getting tired of karma fortunes by now.knc1 ought to be getting tired of karma fortunes by now.knc1 ought to be getting tired of karma fortunes by now.knc1 ought to be getting tired of karma fortunes by now.knc1 ought to be getting tired of karma fortunes by now.knc1 ought to be getting tired of karma fortunes by now.knc1 ought to be getting tired of karma fortunes by now.
 
knc1's Avatar
 
Posts: 17,212
Karma: 18210809
Join Date: Feb 2012
Location: Central Texas
Device: No K1, PW2, KV, KOA
Quote:
Originally Posted by aditya3098 View Post
If you check the simple debricking thread (sticky), you will find some "forensic" images i.e unmodifed root and diag partitions (p1, p2). P3 can be dumped (dd if=/dev/zero of=/dev/mmcblk0p3 bs=4K count=1024) and you can backup the usb drive by backing up all files (duh!).
The usb drive is FAT, so ...
if you backup /dev/mmcblk0p4 at the device level, you backup the entire file system, including "deleted" files.

Which you can (off-kindle) un-delete within the usual limitations of msdos FAT un-delete tools.

Note: When you mount the image of mmcblk0p4 you have to specifiy an offset to losetup so that it can find the start of the file system in the image of the media (same as you would have to do with the image of a bootable floppy disk).

Last edited by knc1; 06-15-2012 at 08:41 AM.
knc1 is offline   Reply With Quote