Prev: Crashes at Stop of Search for Files and Folders
Next: *leftover user account folders not removable
From: Arno on 18 Jan 2010 19:56
In comp.sys.ibm.pc.hardware.storage mynick <anglomont(a)yahoo.com> wrote:
> Is there some undelete software that can run only locally and undelete
> from a mapped network ntfs disk without the aid of an client/agent
> installed/running on that remote computer?

I doubt that very much, as the filesystem will not export
the required information over the network.

Arno

--
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno(a)wagner.name
GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans
From: mscotgrove on 19 Jan 2010 14:24
On Jan 19, 3:23 pm, mynick <anglom...(a)yahoo.com> wrote:
> On Jan 19, 1:56 am, Arno <m...(a)privacy.net> wrote:
>
>
>
>
>
> > In comp.sys.ibm.pc.hardware.storage mynick <anglom...(a)yahoo.com> wrote:
>
> > > Is there some undelete software that can run only locally and undelete
> > > from a mapped network ntfs disk without the aid of an client/agent
> > > installed/running on thatremotecomputer?
>
> > I doubt that very much, as the filesystem will not export
> > the required information over the network.
>
> > Arno
>
> > --
> > Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: a...(a)wagner..name
> > GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
> > ----
> > Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans
>
> why not send info from hdd directly over tcp/ip instead of an agent
> doing the hdd search remotely and just sending the resulting list to
> local- Hide quoted text -
>
> - Show quoted text -

Could you expand on this please.

To undelete a file it is necessary to access the hard drive on a
sector level, and rewrite the MFT entry. There is no way I am aware
of doing this over a general purpose ethernet link. If this was
easily possible, network security would be a complete nightmare.

Michael
From: Arno on 19 Jan 2010 15:24
In comp.sys.ibm.pc.hardware.storage mynick <anglomont(a)yahoo.com> wrote:
> On Jan 19, 1:56 am, Arno <m...(a)privacy.net> wrote:
>> In comp.sys.ibm.pc.hardware.storage mynick <anglom...(a)yahoo.com> wrote:
>>
>> > Is there some undelete software that can run only locally and undelete
>> > from a mapped network ntfs disk without the aid of an client/agent
>> > installed/running on thatremotecomputer?
>>
>> I doubt that very much, as the filesystem will not export
>> the required information over the network.
>>
>> Arno
>>
>> --
>> Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: a...(a)wagner.name
>> GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F
>> ----
>> Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

> why not send info from hdd directly over tcp/ip instead of an agent
> doing the hdd search remotely and just sending the resulting list to
> local

What you get over the net is not NTFT, it is likely SMB. SMB
does not expose the details needed for undelete.

The reason NTFS is not ecported directly, is that there are
a number of problems with doing that, for example cache coherence.
SMB solves these, while NTFS does not.

Arno
--
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno(a)wagner.name
GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans
From: David Brown on 19 Jan 2010 17:04
mscotgrove(a)aol.com wrote:
> On Jan 19, 3:23 pm, mynick <anglom...(a)yahoo.com> wrote:
>> On Jan 19, 1:56 am, Arno <m...(a)privacy.net> wrote:
>>
>>
>>
>>
>>
>>> In comp.sys.ibm.pc.hardware.storage mynick <anglom...(a)yahoo.com> wrote:
>>>> Is there some undelete software that can run only locally and undelete
>>>> from a mapped network ntfs disk without the aid of an client/agent
>>>> installed/running on thatremotecomputer?
>>> I doubt that very much, as the filesystem will not export
>>> the required information over the network.
>>> Arno
>>> --
>>> Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: a...(a)wagner.name
>>> GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F
>>> ----
>>> Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans
>> why not send info from hdd directly over tcp/ip instead of an agent
>> doing the hdd search remotely and just sending the resulting list to
>> local- Hide quoted text -
>>
>> - Show quoted text -
>
> Could you expand on this please.
>
> To undelete a file it is necessary to access the hard drive on a
> sector level, and rewrite the MFT entry. There is no way I am aware
> of doing this over a general purpose ethernet link. If this was
> easily possible, network security would be a complete nightmare.
>

It is perfectly possible to do this over Ethernet - the most common way
is to use iSCSI (network block devices with *nix are another
possibility). Of course, this involves making the partition effectively
invisible to the host (server) machine, and mounted on the guest machine
as though it were a local drive. I don't know what sort of support
windows has for iSCSI, either as a target or initiator. And it is
clearly impractical for the issue at hand. But it /is/ possible to give
direct low-level access to a hard drive over a network.
From: mscotgrove on 19 Jan 2010 18:07
On Jan 19, 10:04 pm, David Brown
<david.br...(a)hesbynett.removethisbit.no> wrote:
> mscotgr...(a)aol.com wrote:
> > On Jan 19, 3:23 pm, mynick <anglom...(a)yahoo.com> wrote:
> >> On Jan 19, 1:56 am, Arno <m...(a)privacy.net> wrote:
>
> >>> In comp.sys.ibm.pc.hardware.storage mynick <anglom...(a)yahoo.com> wrote:
> >>>> Is there some undelete software that can run only locally and undelete
> >>>> from a mapped network ntfs disk without the aid of an client/agent
> >>>> installed/running on thatremotecomputer?
> >>> I doubt that very much, as the filesystem will not export
> >>> the required information over the network.
> >>> Arno
> >>> --
> >>> Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: a...(a)wagner.name
> >>> GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
> >>> ----
> >>> Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans
> >> why not send info from hdd directly over tcp/ip instead of an agent
> >> doing the hdd search remotely and just sending the resulting list to
> >> local- Hide quoted text -
>
> >> - Show quoted text -
>
> > Could you expand on this please.
>
> > To undelete a file it is necessary to access the hard drive on a
> > sector level, and rewrite the MFT entry.  There is no way I am aware
> > of doing this over a general purpose ethernet link.  If this was
> > easily possible, network security would be a complete nightmare.
>
> It is perfectly possible to do this over Ethernet - the most common way
> is to use iSCSI (network block devices with *nix are another
> possibility).  Of course, this involves making the partition effectively
> invisible to the host (server) machine, and mounted on the guest machine
> as though it were a local drive.  I don't know what sort of support
> windows has for iSCSI, either as a target or initiator.  And it is
> clearly impractical for the issue at hand.  But it /is/ possible to give
> direct low-level access to a hard drive over a network.- Hide quoted text -
>
> - Show quoted text -

The question asked for access without a "client /agent
installed/running on that remote computer"

I think you will find that iSCSI has to be set up on BOTH ends -
please say if I am wrong

With a client app installed, there is no problem, but as a straight
mapped drive, I think it is impossible.

Michael
First  |  Prev  |  Next  |  Last
Pages: 1 2 3 4
Prev: Crashes at Stop of Search for Files and Folders
Next: *leftover user account folders not removable