Remote undelete?

[mynick]

Is there some undelete software that can run only locally and undelete
from a mapped network ntfs disk without the aid of an client/agent
installed/running on that remote computer?

 

[mscotgrove]

Is there some undelete software that can run only locally and undelete
from a mapped network ntfs disk without the aid of an client/agent
installed/running on that remote computer?

To perform a an undelete it is necessary to access the hard drive
directly, and manipulate a bit in the MFT sector.

A mapped drive is a logical drive, that need not actually be NTFS, it
just needs to creates, read, write files etc.

My quick answer is that this is not possible without a client
application being loaded, but I too would be interested if there was a
solution

Michael

 

[Arno]

Is there some undelete software that can run only locally and undelete
from a mapped network ntfs disk without the aid of an client/agent
installed/running on that remote computer?

I doubt that very much, as the filesystem will not export
the required information over the network.

Arno

 

[mscotgrove]

why not send info from hdd directly over tcp/ip instead of an agent
doing the hdd search remotely and just sending the resulting list to
local- Hide quoted text -

- Show quoted text -

Could you expand on this please.

To undelete a file it is necessary to access the hard drive on a
sector level, and rewrite the MFT entry. There is no way I am aware
of doing this over a general purpose ethernet link. If this was
easily possible, network security would be a complete nightmare.

Michael

 

[Arno]

why not send info from hdd directly over tcp/ip instead of an agent
doing the hdd search remotely and just sending the resulting list to
local

What you get over the net is not NTFT, it is likely SMB. SMB
does not expose the details needed for undelete.

The reason NTFS is not ecported directly, is that there are
a number of problems with doing that, for example cache coherence.
SMB solves these, while NTFS does not.

Arno

 

[mscotgrove]

It is perfectly possible to do this over Ethernet - the most common way
is to use iSCSI (network block devices with *nix are another
possibility).  Of course, this involves making the partition effectively
invisible to the host (server) machine, and mounted on the guest machine
as though it were a local drive.  I don't know what sort of support
windows has for iSCSI, either as a target or initiator.  And it is
clearly impractical for the issue at hand.  But it /is/ possible to give
direct low-level access to a hard drive over a network.- Hide quoted text-

- Show quoted text -

The question asked for access without a "client /agent
installed/running on that remote computer"

I think you will find that iSCSI has to be set up on BOTH ends -
please say if I am wrong

With a client app installed, there is no problem, but as a straight
mapped drive, I think it is impossible.

Michael

 

[mynick]

The question asked for access without a "client /agent
installed/running on thatremotecomputer"

I think you will find that iSCSI has to be set up on BOTH ends -
please say if I am wrong

With a client app installed, there is no problem, but as a straight
mapped drive, I think it is impossible.

Michael

how about remote if this is undelete :
disk/folder scanning to find deleted entries in Root Folder (FAT) or
Master File Table (NTFS) then for the particular deleted entry,
defining clusters chain to be recovered and then copying contents of
these clusters to the newly created file
(another way to undelete is scanning disks empty space for signatures/
traces of known file types of interest and I doubt that can be done
over tcp/ip )

 

[David Brown]

The question asked for access without a "client /agent
installed/running on that remote computer"

I think you will find that iSCSI has to be set up on BOTH ends -
please say if I am wrong

You are entirely correct - iSCSI needs to be configured at both ends. I
was just pointing out that such low-level disk sharing is certainly
possible, if you choose to use it.

With a client app installed, there is no problem, but as a straight
mapped drive, I think it is impossible.

One possibility is that windows has a number of backdoors that allow
execution of software on a remote machine without actively installing
something there. The simplest and safest tools are probably things like
psexec from the SysInternals Suite (download from MS). psexec lets you
execute commands directly on a remote machine, assuming you have an
administrator password for the machine.

 

[mynick]

You are entirely correct - iSCSI needs to be configured at both ends.  I
was just pointing out that such low-level disk sharing is certainly
possible, if you choose to use it.


One possibility is that windows has a number of backdoors that allow
execution of software on aremotemachine without actively installing
something there.  The simplest and safest tools are probably things like
psexec from the SysInternals Suite (download from MS).  psexec lets you
execute commands directly on aremotemachine, assuming you have an
administrator password for the machine.

what do you think of nbd protocol?
running nbdsrvr on remote if that does not require special privilleges
on remote
and than using Selfimage which supports nbd (but perhaps not the
nbdsrvr.exe version)

 

[David Brown]

what do you think of nbd protocol?
running nbdsrvr on remote if that does not require special privilleges
on remote
and than using Selfimage which supports nbd (but perhaps not the
nbdsrvr.exe version)

I've only used nbd with Linux systems (to give an embedded Linux system
a swap disk) - I have no idea about support in windows for nbd. But
generally speaking, if you are using nbd to "share" a partition, the
partition cannot also be accessed locally.

 

[mynick]

I've only used nbd with Linux systems (to give an embedded Linux system
a swap disk) - I have no idea about support in windows for nbd.  But
generally speaking, if you are using nbd to "share" a partition, the
partition cannot also be accessed locally.

nbdsrvr for win can be found at http://www.vanheusden.com/
however nbd readme says
Do *NOT* share partitions/files that are already in mounted/in use! It
is
almost for sure that corruptions will occure???
-is that what 'cannot' meant
and would it make difference if there would be only 1 PC accesing the
remote share ?
Another idea might be using running locally and remotely dd command
for win- perhaps that could go through smb
(and after copying dd to mapped share it could be started via telnet
because above mentioned psexec expects it on remote in c:\windows
which is not accessible)

 

[David Brown]

nbdsrvr for win can be found at http://www.vanheusden.com/
however nbd readme says
Do *NOT* share partitions/files that are already in mounted/in use! It
is
almost for sure that corruptions will occure???
-is that what 'cannot' meant
and would it make difference if there would be only 1 PC accesing the
remote share ?

When I say "cannot", I really mean "should not" - and the OS should
hopefully enforce that limitation. The rule is that only one writer
should ever have low-level access to a partition (or file used as a
block device - that's the common usage for nbd). You can have multiple
read-only connections at a time, but if you try to allow two different
file system drivers to write to the same partition, you are guaranteed
chaos and corruption.

Another idea might be using running locally and remotely dd command
for win- perhaps that could go through smb
(and after copying dd to mapped share it could be started via telnet
because above mentioned psexec expects it on remote in c:\windows
which is not accessible)

The trick is to use "psexec \\remoteserver cmd" to start a remote
command prompt - a poor man's telnet. But if you have a telnet or ssh
server on the remote machine, use that.