1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Remote undelete?

Discussion in 'Windows XP' started by mynick, Jan 17, 2010.

  1. mynick

    mynick Flightless Bird

    Is there some undelete software that can run only locally and undelete
    from a mapped network ntfs disk without the aid of an client/agent
    installed/running on that remote computer?
     
  2. Pegasus [MVP]

    Pegasus [MVP] Flightless Bird

    "mynick" <anglomont@yahoo.com> said this in news item
    news:e1814b36-2498-494b-b410-033fe8726fda@o28g2000yqh.googlegroups.com...
    > Is there some undelete software that can run only locally and undelete
    > from a mapped network ntfs disk without the aid of an client/agent
    > installed/running on that remote computer?


    I know of two options to delete a remote file:
    a) By deleting it via a shared folder. If so then the delete program runs on
    your own machine and not locally on the other PC.
    b) By using a tool such as psexec.exe. If so then the delete program runs
    locally on the other machine but it requires an agent.

    It seems your requirements contradict each other.
     
  3. mscotgrove@aol.com

    mscotgrove@aol.com Flightless Bird

    On Jan 18, 2:15 am, mynick <anglom...@yahoo.com> wrote:
    > Is there some undelete software that can run only locally and undelete
    > from a mapped network ntfs disk without the aid of an client/agent
    > installed/running on that remote computer?


    To perform a an undelete it is necessary to access the hard drive
    directly, and manipulate a bit in the MFT sector.

    A mapped drive is a logical drive, that need not actually be NTFS, it
    just needs to creates, read, write files etc.

    My quick answer is that this is not possible without a client
    application being loaded, but I too would be interested if there was a
    solution

    Michael
     
  4. mynick

    mynick Flightless Bird

    On Jan 18, 8:06 am, "Pegasus [MVP]" <n...@microsoft.com> wrote:
    > "mynick" <anglom...@yahoo.com> said this in news itemnews:e1814b36-2498-494b-b410-033fe8726fda@o28g2000yqh.googlegroups.com...
    >
    > > Is there some undelete software that can run only locally and undelete
    > > from a mapped network ntfs disk without the aid of an client/agent
    > > installed/running on that remote computer?

    >
    > I know of two options to delete a remote file:
    > a) By deleting it via a shared folder. If so then the delete program runs on
    > your own machine and not locally on the other PC.
    > b) By using a tool such as psexec.exe. If so then the delete program runs
    > locally on the other machine but it requires an agent.
    >
    > It seems your requirements contradict each other.

    Thanks!
    Could one not start locally for example Photorec(console app) to run
    on remote PC using Psexec, only
    it will probably not offer local, only remote disk as a place to store
    undeleted files? Undeleting-copying to same remote disk would
    risk corrupting the files so would be great to instead of photorec
    somehow make use of old norton unerase.exe which does in-place udelete
    (but it does not support MFT(NTFS) and would probably require first
    locking direct disk access to unerase.exe as for example Active
    uneraser for DOS.)
    Is there another console unerase application that can do in place
    undelete for ntfs?
     
  5. Pegasus [MVP]

    Pegasus [MVP] Flightless Bird

    "mynick" <anglomont@yahoo.com> said this in news item
    news:5fc622fa-3347-4c93-a4c8-48b25151b8b0@r5g2000yqb.googlegroups.com...
    > On Jan 18, 8:06 am, "Pegasus [MVP]" <n...@microsoft.com> wrote:
    >> "mynick" <anglom...@yahoo.com> said this in news
    >> itemnews:e1814b36-2498-494b-b410-033fe8726fda@o28g2000yqh.googlegroups.com...
    >>
    >> > Is there some undelete software that can run only locally and undelete
    >> > from a mapped network ntfs disk without the aid of an client/agent
    >> > installed/running on that remote computer?

    >>
    >> I know of two options to delete a remote file:
    >> a) By deleting it via a shared folder. If so then the delete program runs
    >> on
    >> your own machine and not locally on the other PC.
    >> b) By using a tool such as psexec.exe. If so then the delete program runs
    >> locally on the other machine but it requires an agent.
    >>
    >> It seems your requirements contradict each other.

    > Thanks!
    > Could one not start locally for example Photorec(console app) to run
    > on remote PC using Psexec, only
    > it will probably not offer local, only remote disk as a place to store
    > undeleted files? Undeleting-copying to same remote disk would
    > risk corrupting the files so would be great to instead of photorec
    > somehow make use of old norton unerase.exe which does in-place udelete
    > (but it does not support MFT(NTFS) and would probably require first
    > locking direct disk access to unerase.exe as for example Active
    > uneraser for DOS.)
    > Is there another console unerase application that can do in place
    > undelete for ntfs?


    Sorry, I missed the "un" (as in "undelete") in your first post. I can't
    really say anything about undeleting files, neither locally nor remotely.
     
  6. Arno

    Arno Flightless Bird

    In comp.sys.ibm.pc.hardware.storage mynick <anglomont@yahoo.com> wrote:
    > Is there some undelete software that can run only locally and undelete
    > from a mapped network ntfs disk without the aid of an client/agent
    > installed/running on that remote computer?


    I doubt that very much, as the filesystem will not export
    the required information over the network.

    Arno

    --
    Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name
    GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F
    ----
    Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans
     
  7. mscotgrove@aol.com

    mscotgrove@aol.com Flightless Bird

    On Jan 19, 3:23 pm, mynick <anglom...@yahoo.com> wrote:
    > On Jan 19, 1:56 am, Arno <m...@privacy.net> wrote:
    >
    >
    >
    >
    >
    > > In comp.sys.ibm.pc.hardware.storage mynick <anglom...@yahoo.com> wrote:

    >
    > > > Is there some undelete software that can run only locally and undelete
    > > > from a mapped network ntfs disk without the aid of an client/agent
    > > > installed/running on thatremotecomputer?

    >
    > > I doubt that very much, as the filesystem will not export
    > > the required information over the network.

    >
    > > Arno

    >
    > > --
    > > Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: a...@wagner..name
    > > GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
    > > ----
    > > Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

    >
    > why not send info from hdd directly over tcp/ip instead of an agent
    > doing the hdd search remotely and just sending the resulting list to
    > local- Hide quoted text -
    >
    > - Show quoted text -


    Could you expand on this please.

    To undelete a file it is necessary to access the hard drive on a
    sector level, and rewrite the MFT entry. There is no way I am aware
    of doing this over a general purpose ethernet link. If this was
    easily possible, network security would be a complete nightmare.

    Michael
     
  8. Arno

    Arno Flightless Bird

    In comp.sys.ibm.pc.hardware.storage mynick <anglomont@yahoo.com> wrote:
    > On Jan 19, 1:56 am, Arno <m...@privacy.net> wrote:
    >> In comp.sys.ibm.pc.hardware.storage mynick <anglom...@yahoo.com> wrote:
    >>
    >> > Is there some undelete software that can run only locally and undelete
    >> > from a mapped network ntfs disk without the aid of an client/agent
    >> > installed/running on thatremotecomputer?

    >>
    >> I doubt that very much, as the filesystem will not export
    >> the required information over the network.
    >>
    >> Arno
    >>
    >> --
    >> Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: a...@wagner.name
    >> GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F
    >> ----
    >> Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans


    > why not send info from hdd directly over tcp/ip instead of an agent
    > doing the hdd search remotely and just sending the resulting list to
    > local


    What you get over the net is not NTFT, it is likely SMB. SMB
    does not expose the details needed for undelete.

    The reason NTFS is not ecported directly, is that there are
    a number of problems with doing that, for example cache coherence.
    SMB solves these, while NTFS does not.

    Arno
    --
    Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name
    GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F
    ----
    Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans
     
  9. David Brown

    David Brown Flightless Bird

    mscotgrove@aol.com wrote:
    > On Jan 19, 3:23 pm, mynick <anglom...@yahoo.com> wrote:
    >> On Jan 19, 1:56 am, Arno <m...@privacy.net> wrote:
    >>
    >>
    >>
    >>
    >>
    >>> In comp.sys.ibm.pc.hardware.storage mynick <anglom...@yahoo.com> wrote:
    >>>> Is there some undelete software that can run only locally and undelete
    >>>> from a mapped network ntfs disk without the aid of an client/agent
    >>>> installed/running on thatremotecomputer?
    >>> I doubt that very much, as the filesystem will not export
    >>> the required information over the network.
    >>> Arno
    >>> --
    >>> Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: a...@wagner.name
    >>> GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F
    >>> ----
    >>> Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

    >> why not send info from hdd directly over tcp/ip instead of an agent
    >> doing the hdd search remotely and just sending the resulting list to
    >> local- Hide quoted text -
    >>
    >> - Show quoted text -

    >
    > Could you expand on this please.
    >
    > To undelete a file it is necessary to access the hard drive on a
    > sector level, and rewrite the MFT entry. There is no way I am aware
    > of doing this over a general purpose ethernet link. If this was
    > easily possible, network security would be a complete nightmare.
    >


    It is perfectly possible to do this over Ethernet - the most common way
    is to use iSCSI (network block devices with *nix are another
    possibility). Of course, this involves making the partition effectively
    invisible to the host (server) machine, and mounted on the guest machine
    as though it were a local drive. I don't know what sort of support
    windows has for iSCSI, either as a target or initiator. And it is
    clearly impractical for the issue at hand. But it /is/ possible to give
    direct low-level access to a hard drive over a network.
     
  10. mscotgrove@aol.com

    mscotgrove@aol.com Flightless Bird

    On Jan 19, 10:04 pm, David Brown
    <david.br...@hesbynett.removethisbit.no> wrote:
    > mscotgr...@aol.com wrote:
    > > On Jan 19, 3:23 pm, mynick <anglom...@yahoo.com> wrote:
    > >> On Jan 19, 1:56 am, Arno <m...@privacy.net> wrote:

    >
    > >>> In comp.sys.ibm.pc.hardware.storage mynick <anglom...@yahoo.com> wrote:
    > >>>> Is there some undelete software that can run only locally and undelete
    > >>>> from a mapped network ntfs disk without the aid of an client/agent
    > >>>> installed/running on thatremotecomputer?
    > >>> I doubt that very much, as the filesystem will not export
    > >>> the required information over the network.
    > >>> Arno
    > >>> --
    > >>> Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: a...@wagner.name
    > >>> GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
    > >>> ----
    > >>> Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans
    > >> why not send info from hdd directly over tcp/ip instead of an agent
    > >> doing the hdd search remotely and just sending the resulting list to
    > >> local- Hide quoted text -

    >
    > >> - Show quoted text -

    >
    > > Could you expand on this please.

    >
    > > To undelete a file it is necessary to access the hard drive on a
    > > sector level, and rewrite the MFT entry.  There is no way I am aware
    > > of doing this over a general purpose ethernet link.  If this was
    > > easily possible, network security would be a complete nightmare.

    >
    > It is perfectly possible to do this over Ethernet - the most common way
    > is to use iSCSI (network block devices with *nix are another
    > possibility).  Of course, this involves making the partition effectively
    > invisible to the host (server) machine, and mounted on the guest machine
    > as though it were a local drive.  I don't know what sort of support
    > windows has for iSCSI, either as a target or initiator.  And it is
    > clearly impractical for the issue at hand.  But it /is/ possible to give
    > direct low-level access to a hard drive over a network.- Hide quoted text-
    >
    > - Show quoted text -


    The question asked for access without a "client /agent
    installed/running on that remote computer"

    I think you will find that iSCSI has to be set up on BOTH ends -
    please say if I am wrong

    With a client app installed, there is no problem, but as a straight
    mapped drive, I think it is impossible.

    Michael
     
  11. mynick

    mynick Flightless Bird

    On Jan 19, 3:07 pm, "mscotgr...@aol.com" <mscotgr...@aol.com> wrote:
    > On Jan 19, 10:04 pm, David Brown
    >
    >
    >
    > <david.br...@hesbynett.removethisbit.no> wrote:
    > > mscotgr...@aol.com wrote:
    > > > On Jan 19, 3:23 pm, mynick <anglom...@yahoo.com> wrote:
    > > >> On Jan 19, 1:56 am, Arno <m...@privacy.net> wrote:

    >
    > > >>> In comp.sys.ibm.pc.hardware.storage mynick <anglom...@yahoo.com> wrote:
    > > >>>> Is there someundeletesoftware that can run only locally andundelete
    > > >>>> from a mapped network ntfs disk without the aid of an client/agent
    > > >>>> installed/running on thatremotecomputer?
    > > >>> I doubt that very much, as the filesystem will not export
    > > >>> the required information over the network.
    > > >>> Arno
    > > >>> --
    > > >>> Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: a...@wagner.name
    > > >>> GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F6B50 1E25 338F
    > > >>> ----
    > > >>> Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans
    > > >> why not send info from hdd directly over tcp/ip instead of an agent
    > > >> doing the hdd search remotely and just sending the resulting list to
    > > >> local- Hide quoted text -

    >
    > > >> - Show quoted text -

    >
    > > > Could you expand on this please.

    >
    > > > Toundeletea file it is necessary to access the hard drive on a
    > > > sector level, and rewrite the MFT entry.  There is no way I am aware
    > > > of doing this over a general purpose ethernet link.  If this was
    > > > easily possible, network security would be a complete nightmare.

    >
    > > It is perfectly possible to do this over Ethernet - the most common way
    > > is to use iSCSI (network block devices with *nix are another
    > > possibility).  Of course, this involves making the partition effectively
    > > invisible to the host (server) machine, and mounted on the guest machine
    > > as though it were a local drive.  I don't know what sort of support
    > > windows has for iSCSI, either as a target or initiator.  And it is
    > > clearly impractical for the issue at hand.  But it /is/ possible to give
    > > direct low-level access to a hard drive over a network.- Hide quoted text -

    >
    > > - Show quoted text -

    >
    > The question asked for access without a "client /agent
    > installed/running on thatremotecomputer"
    >
    > I think you will find that iSCSI has to be set up on BOTH ends -
    > please say if I am wrong
    >
    > With a client app installed, there is no problem, but as a straight
    > mapped drive, I think it is impossible.
    >
    > Michael


    how about remote if this is undelete :
    disk/folder scanning to find deleted entries in Root Folder (FAT) or
    Master File Table (NTFS) then for the particular deleted entry,
    defining clusters chain to be recovered and then copying contents of
    these clusters to the newly created file
    (another way to undelete is scanning disks empty space for signatures/
    traces of known file types of interest and I doubt that can be done
    over tcp/ip )
     
  12. David Brown

    David Brown Flightless Bird

    mscotgrove@aol.com wrote:
    > On Jan 19, 10:04 pm, David Brown
    > <david.br...@hesbynett.removethisbit.no> wrote:
    >> mscotgr...@aol.com wrote:
    >>> On Jan 19, 3:23 pm, mynick <anglom...@yahoo.com> wrote:
    >>>> On Jan 19, 1:56 am, Arno <m...@privacy.net> wrote:
    >>>>> In comp.sys.ibm.pc.hardware.storage mynick <anglom...@yahoo.com> wrote:
    >>>>>> Is there some undelete software that can run only locally and undelete
    >>>>>> from a mapped network ntfs disk without the aid of an client/agent
    >>>>>> installed/running on thatremotecomputer?
    >>>>> I doubt that very much, as the filesystem will not export
    >>>>> the required information over the network.
    >>>>> Arno
    >>>>> --
    >>>>> Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: a...@wagner.name
    >>>>> GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F
    >>>>> ----
    >>>>> Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans
    >>>> why not send info from hdd directly over tcp/ip instead of an agent
    >>>> doing the hdd search remotely and just sending the resulting list to
    >>>> local- Hide quoted text -
    >>>> - Show quoted text -
    >>> Could you expand on this please.
    >>> To undelete a file it is necessary to access the hard drive on a
    >>> sector level, and rewrite the MFT entry. There is no way I am aware
    >>> of doing this over a general purpose ethernet link. If this was
    >>> easily possible, network security would be a complete nightmare.

    >> It is perfectly possible to do this over Ethernet - the most common way
    >> is to use iSCSI (network block devices with *nix are another
    >> possibility). Of course, this involves making the partition effectively
    >> invisible to the host (server) machine, and mounted on the guest machine
    >> as though it were a local drive. I don't know what sort of support
    >> windows has for iSCSI, either as a target or initiator. And it is
    >> clearly impractical for the issue at hand. But it /is/ possible to give
    >> direct low-level access to a hard drive over a network.- Hide quoted text -
    >>
    >> - Show quoted text -

    >
    > The question asked for access without a "client /agent
    > installed/running on that remote computer"
    >
    > I think you will find that iSCSI has to be set up on BOTH ends -
    > please say if I am wrong
    >


    You are entirely correct - iSCSI needs to be configured at both ends. I
    was just pointing out that such low-level disk sharing is certainly
    possible, if you choose to use it.

    > With a client app installed, there is no problem, but as a straight
    > mapped drive, I think it is impossible.
    >


    One possibility is that windows has a number of backdoors that allow
    execution of software on a remote machine without actively installing
    something there. The simplest and safest tools are probably things like
    psexec from the SysInternals Suite (download from MS). psexec lets you
    execute commands directly on a remote machine, assuming you have an
    administrator password for the machine.
     
  13. mynick

    mynick Flightless Bird

    On Jan 19, 11:59 pm, David Brown <da...@westcontrol.removethisbit.com>
    wrote:
    > mscotgr...@aol.com wrote:
    > > On Jan 19, 10:04 pm, David Brown
    > > <david.br...@hesbynett.removethisbit.no> wrote:
    > >> mscotgr...@aol.com wrote:
    > >>> On Jan 19, 3:23 pm, mynick <anglom...@yahoo.com> wrote:
    > >>>> On Jan 19, 1:56 am, Arno <m...@privacy.net> wrote:
    > >>>>> In comp.sys.ibm.pc.hardware.storage mynick <anglom...@yahoo.com> wrote:
    > >>>>>> Is there some undelete software that can run only locally and undelete
    > >>>>>> from a mapped network ntfs disk without the aid of an client/agent
    > >>>>>> installed/running on thatremotecomputer?
    > >>>>> I doubt that very much, as the filesystem will not export
    > >>>>> the required information over the network.
    > >>>>> Arno
    > >>>>> --
    > >>>>> Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: a...@wagner.name
    > >>>>> GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F6B50 1E25 338F
    > >>>>> ----
    > >>>>> Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans
    > >>>> why not send info from hdd directly over tcp/ip instead of an agent
    > >>>> doing the hdd search remotely and just sending the resulting list to
    > >>>> local- Hide quoted text -
    > >>>> - Show quoted text -
    > >>> Could you expand on this please.
    > >>> To undelete a file it is necessary to access the hard drive on a
    > >>> sector level, and rewrite the MFT entry.  There is no way I am aware
    > >>> of doing this over a general purpose ethernet link.  If this was
    > >>> easily possible, network security would be a complete nightmare.
    > >> It is perfectly possible to do this over Ethernet - the most common way
    > >> is to use iSCSI (network block devices with *nix are another
    > >> possibility).  Of course, this involves making the partition effectively
    > >> invisible to the host (server) machine, and mounted on the guest machine
    > >> as though it were a local drive.  I don't know what sort of support
    > >> windows has for iSCSI, either as a target or initiator.  And it is
    > >> clearly impractical for the issue at hand.  But it /is/ possible to give
    > >> direct low-level access to a hard drive over a network.- Hide quoted text -

    >
    > >> - Show quoted text -

    >
    > > The question asked for access without a "client /agent
    > > installed/running on thatremotecomputer"

    >
    > > I think you will find that iSCSI has to be set up on BOTH ends -
    > > please say if I am wrong

    >
    > You are entirely correct - iSCSI needs to be configured at both ends.  I
    > was just pointing out that such low-level disk sharing is certainly
    > possible, if you choose to use it.
    >
    > > With a client app installed, there is no problem, but as a straight
    > > mapped drive, I think it is impossible.

    >
    > One possibility is that windows has a number of backdoors that allow
    > execution of software on aremotemachine without actively installing
    > something there.  The simplest and safest tools are probably things like
    > psexec from the SysInternals Suite (download from MS).  psexec lets you
    > execute commands directly on aremotemachine, assuming you have an
    > administrator password for the machine.


    what do you think of nbd protocol?
    running nbdsrvr on remote if that does not require special privilleges
    on remote
    and than using Selfimage which supports nbd (but perhaps not the
    nbdsrvr.exe version)
     
  14. David Brown

    David Brown Flightless Bird

    mynick wrote:
    > On Jan 19, 11:59 pm, David Brown <da...@westcontrol.removethisbit.com>
    > wrote:
    >> mscotgr...@aol.com wrote:
    >>> On Jan 19, 10:04 pm, David Brown
    >>> <david.br...@hesbynett.removethisbit.no> wrote:
    >>>> mscotgr...@aol.com wrote:
    >>>>> On Jan 19, 3:23 pm, mynick <anglom...@yahoo.com> wrote:
    >>>>>> On Jan 19, 1:56 am, Arno <m...@privacy.net> wrote:
    >>>>>>> In comp.sys.ibm.pc.hardware.storage mynick <anglom...@yahoo.com> wrote:
    >>>>>>>> Is there some undelete software that can run only locally and undelete
    >>>>>>>> from a mapped network ntfs disk without the aid of an client/agent
    >>>>>>>> installed/running on thatremotecomputer?
    >>>>>>> I doubt that very much, as the filesystem will not export
    >>>>>>> the required information over the network.
    >>>>>>> Arno
    >>>>>>> --
    >>>>>>> Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: a...@wagner.name
    >>>>>>> GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F
    >>>>>>> ----
    >>>>>>> Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans
    >>>>>> why not send info from hdd directly over tcp/ip instead of an agent
    >>>>>> doing the hdd search remotely and just sending the resulting list to
    >>>>>> local- Hide quoted text -
    >>>>>> - Show quoted text -
    >>>>> Could you expand on this please.
    >>>>> To undelete a file it is necessary to access the hard drive on a
    >>>>> sector level, and rewrite the MFT entry. There is no way I am aware
    >>>>> of doing this over a general purpose ethernet link. If this was
    >>>>> easily possible, network security would be a complete nightmare.
    >>>> It is perfectly possible to do this over Ethernet - the most common way
    >>>> is to use iSCSI (network block devices with *nix are another
    >>>> possibility). Of course, this involves making the partition effectively
    >>>> invisible to the host (server) machine, and mounted on the guest machine
    >>>> as though it were a local drive. I don't know what sort of support
    >>>> windows has for iSCSI, either as a target or initiator. And it is
    >>>> clearly impractical for the issue at hand. But it /is/ possible to give
    >>>> direct low-level access to a hard drive over a network.- Hide quoted text -
    >>>> - Show quoted text -
    >>> The question asked for access without a "client /agent
    >>> installed/running on thatremotecomputer"
    >>> I think you will find that iSCSI has to be set up on BOTH ends -
    >>> please say if I am wrong

    >> You are entirely correct - iSCSI needs to be configured at both ends. I
    >> was just pointing out that such low-level disk sharing is certainly
    >> possible, if you choose to use it.
    >>
    >>> With a client app installed, there is no problem, but as a straight
    >>> mapped drive, I think it is impossible.

    >> One possibility is that windows has a number of backdoors that allow
    >> execution of software on aremotemachine without actively installing
    >> something there. The simplest and safest tools are probably things like
    >> psexec from the SysInternals Suite (download from MS). psexec lets you
    >> execute commands directly on aremotemachine, assuming you have an
    >> administrator password for the machine.

    >
    > what do you think of nbd protocol?
    > running nbdsrvr on remote if that does not require special privilleges
    > on remote
    > and than using Selfimage which supports nbd (but perhaps not the
    > nbdsrvr.exe version)


    I've only used nbd with Linux systems (to give an embedded Linux system
    a swap disk) - I have no idea about support in windows for nbd. But
    generally speaking, if you are using nbd to "share" a partition, the
    partition cannot also be accessed locally.
     
  15. mynick

    mynick Flightless Bird

    On Jan 20, 11:51 pm, David Brown <da...@westcontrol.removethisbit.com>
    wrote:
    > mynick wrote:
    > > On Jan 19, 11:59 pm, David Brown <da...@westcontrol.removethisbit.com>
    > > wrote:
    > >> mscotgr...@aol.com wrote:
    > >>> On Jan 19, 10:04 pm, David Brown
    > >>> <david.br...@hesbynett.removethisbit.no> wrote:
    > >>>> mscotgr...@aol.com wrote:
    > >>>>> On Jan 19, 3:23 pm, mynick <anglom...@yahoo.com> wrote:
    > >>>>>> On Jan 19, 1:56 am, Arno <m...@privacy.net> wrote:
    > >>>>>>> In comp.sys.ibm.pc.hardware.storage mynick <anglom...@yahoo.com> wrote:
    > >>>>>>>> Is there some undelete software that can run only locally and undelete
    > >>>>>>>> from a mapped network ntfs disk without the aid of an client/agent
    > >>>>>>>> installed/running on thatremotecomputer?
    > >>>>>>> I doubt that very much, as the filesystem will not export
    > >>>>>>> the required information over the network.
    > >>>>>>> Arno
    > >>>>>>> --
    > >>>>>>> Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: a...@wagner.name
    > >>>>>>> GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
    > >>>>>>> ----
    > >>>>>>> Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans
    > >>>>>> why not send info from hdd directly over tcp/ip instead of an agent
    > >>>>>> doing the hdd search remotely and just sending the resulting list to
    > >>>>>> local- Hide quoted text -
    > >>>>>> - Show quoted text -
    > >>>>> Could you expand on this please.
    > >>>>> To undelete a file it is necessary to access the hard drive on a
    > >>>>> sector level, and rewrite the MFT entry.  There is no way I am aware
    > >>>>> of doing this over a general purpose ethernet link.  If this was
    > >>>>> easily possible, network security would be a complete nightmare.
    > >>>> It is perfectly possible to do this over Ethernet - the most common way
    > >>>> is to use iSCSI (network block devices with *nix are another
    > >>>> possibility).  Of course, this involves making the partition effectively
    > >>>> invisible to the host (server) machine, and mounted on the guest machine
    > >>>> as though it were a local drive.  I don't know what sort of support
    > >>>> windows has for iSCSI, either as a target or initiator.  And it is
    > >>>> clearly impractical for the issue at hand.  But it /is/ possible to give
    > >>>> direct low-level access to a hard drive over a network.- Hide quotedtext -
    > >>>> - Show quoted text -
    > >>> The question asked for access without a "client /agent
    > >>> installed/running on thatremotecomputer"
    > >>> I think you will find that iSCSI has to be set up on BOTH ends -
    > >>> please say if I am wrong
    > >> You are entirely correct - iSCSI needs to be configured at both ends.  I
    > >> was just pointing out that such low-level disk sharing is certainly
    > >> possible, if you choose to use it.

    >
    > >>> With a client app installed, there is no problem, but as a straight
    > >>> mapped drive, I think it is impossible.
    > >> One possibility is that windows has a number of backdoors that allow
    > >> execution of software on aremotemachine without actively installing
    > >> something there.  The simplest and safest tools are probably things like
    > >> psexec from the SysInternals Suite (download from MS).  psexec lets you
    > >> execute commands directly on aremotemachine, assuming you have an
    > >> administrator password for the machine.

    >
    > > what do you think of nbd protocol?
    > > running nbdsrvr on remote if that does not require special privilleges
    > > on remote
    > > and than using Selfimage which supports nbd (but perhaps not the
    > > nbdsrvr.exe version)

    >
    > I've only used nbd with Linux systems (to give an embedded Linux system
    > a swap disk) - I have no idea about support in windows for nbd.  But
    > generally speaking, if you are using nbd to "share" a partition, the
    > partition cannot also be accessed locally.


    nbdsrvr for win can be found at http://www.vanheusden.com/
    however nbd readme says
    Do *NOT* share partitions/files that are already in mounted/in use! It
    is
    almost for sure that corruptions will occure???
    -is that what 'cannot' meant
    and would it make difference if there would be only 1 PC accesing the
    remote share ?
    Another idea might be using running locally and remotely dd command
    for win- perhaps that could go through smb
    (and after copying dd to mapped share it could be started via telnet
    because above mentioned psexec expects it on remote in c:/windows
    which is not accessible)
     
  16. David Brown

    David Brown Flightless Bird

    mynick wrote:
    > On Jan 20, 11:51 pm, David Brown <da...@westcontrol.removethisbit.com>
    > wrote:
    >> mynick wrote:
    >>> On Jan 19, 11:59 pm, David Brown <da...@westcontrol.removethisbit.com>
    >>> wrote:
    >>>> mscotgr...@aol.com wrote:
    >>>>> On Jan 19, 10:04 pm, David Brown
    >>>>> <david.br...@hesbynett.removethisbit.no> wrote:
    >>>>>> mscotgr...@aol.com wrote:
    >>>>>>> On Jan 19, 3:23 pm, mynick <anglom...@yahoo.com> wrote:
    >>>>>>>> On Jan 19, 1:56 am, Arno <m...@privacy.net> wrote:
    >>>>>>>>> In comp.sys.ibm.pc.hardware.storage mynick <anglom...@yahoo.com> wrote:
    >>>>>>>>>> Is there some undelete software that can run only locally and undelete
    >>>>>>>>>> from a mapped network ntfs disk without the aid of an client/agent
    >>>>>>>>>> installed/running on thatremotecomputer?
    >>>>>>>>> I doubt that very much, as the filesystem will not export
    >>>>>>>>> the required information over the network.
    >>>>>>>>> Arno
    >>>>>>>>> --
    >>>>>>>>> Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: a...@wagner.name
    >>>>>>>>> GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F
    >>>>>>>>> ----
    >>>>>>>>> Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans
    >>>>>>>> why not send info from hdd directly over tcp/ip instead of an agent
    >>>>>>>> doing the hdd search remotely and just sending the resulting list to
    >>>>>>>> local- Hide quoted text -
    >>>>>>>> - Show quoted text -
    >>>>>>> Could you expand on this please.
    >>>>>>> To undelete a file it is necessary to access the hard drive on a
    >>>>>>> sector level, and rewrite the MFT entry. There is no way I am aware
    >>>>>>> of doing this over a general purpose ethernet link. If this was
    >>>>>>> easily possible, network security would be a complete nightmare.
    >>>>>> It is perfectly possible to do this over Ethernet - the most common way
    >>>>>> is to use iSCSI (network block devices with *nix are another
    >>>>>> possibility). Of course, this involves making the partition effectively
    >>>>>> invisible to the host (server) machine, and mounted on the guest machine
    >>>>>> as though it were a local drive. I don't know what sort of support
    >>>>>> windows has for iSCSI, either as a target or initiator. And it is
    >>>>>> clearly impractical for the issue at hand. But it /is/ possible to give
    >>>>>> direct low-level access to a hard drive over a network.- Hide quoted text -
    >>>>>> - Show quoted text -
    >>>>> The question asked for access without a "client /agent
    >>>>> installed/running on thatremotecomputer"
    >>>>> I think you will find that iSCSI has to be set up on BOTH ends -
    >>>>> please say if I am wrong
    >>>> You are entirely correct - iSCSI needs to be configured at both ends. I
    >>>> was just pointing out that such low-level disk sharing is certainly
    >>>> possible, if you choose to use it.
    >>>>> With a client app installed, there is no problem, but as a straight
    >>>>> mapped drive, I think it is impossible.
    >>>> One possibility is that windows has a number of backdoors that allow
    >>>> execution of software on aremotemachine without actively installing
    >>>> something there. The simplest and safest tools are probably things like
    >>>> psexec from the SysInternals Suite (download from MS). psexec lets you
    >>>> execute commands directly on aremotemachine, assuming you have an
    >>>> administrator password for the machine.
    >>> what do you think of nbd protocol?
    >>> running nbdsrvr on remote if that does not require special privilleges
    >>> on remote
    >>> and than using Selfimage which supports nbd (but perhaps not the
    >>> nbdsrvr.exe version)

    >> I've only used nbd with Linux systems (to give an embedded Linux system
    >> a swap disk) - I have no idea about support in windows for nbd. But
    >> generally speaking, if you are using nbd to "share" a partition, the
    >> partition cannot also be accessed locally.

    >
    > nbdsrvr for win can be found at http://www.vanheusden.com/
    > however nbd readme says
    > Do *NOT* share partitions/files that are already in mounted/in use! It
    > is
    > almost for sure that corruptions will occure???
    > -is that what 'cannot' meant
    > and would it make difference if there would be only 1 PC accesing the
    > remote share ?


    When I say "cannot", I really mean "should not" - and the OS should
    hopefully enforce that limitation. The rule is that only one writer
    should ever have low-level access to a partition (or file used as a
    block device - that's the common usage for nbd). You can have multiple
    read-only connections at a time, but if you try to allow two different
    file system drivers to write to the same partition, you are guaranteed
    chaos and corruption.

    > Another idea might be using running locally and remotely dd command
    > for win- perhaps that could go through smb
    > (and after copying dd to mapped share it could be started via telnet
    > because above mentioned psexec expects it on remote in c:/windows
    > which is not accessible)


    The trick is to use "psexec \\remoteserver cmd" to start a remote
    command prompt - a poor man's telnet. But if you have a telnet or ssh
    server on the remote machine, use that.
     

Share This Page