1

I'm working on recovering an image that had the partition table blown away. For other filesystems, I've been able to use Sleuthkit's sigfind and the default templates or specified offset/signature to pick up other filesystems, but I can't find any documentation on what (if any) unique hex patterns/offset will exist within a swap partition.

Obviously swap is very different from a filesystem, but I would assume there is still some moderately unique pattern somewhere in the partition, I just don't know what that would be. I've been googling for a few hrs with no luck so any suggestions would be very much appreciated.

Dan
  • 324

0 Answers0