A chronological documentation test project, nothing serious, really!

14 Apr 2009 Tools to recover Windows CHK-files

This post links to two Windows programs that can help you determine the extension of CHK-files.

A CHK-file is a file that is created when you run a disk repair tool like chkdsk, scandisk or other Windows disk tools.
Often these CHK-files are placed in a FOUND.000 folder and contains several FILE0001.CHK FILE0002.CHK … files and are being deleted by users because they don’t know what to do with them.

I’ve successfully used UnCHK and FileCHK in Windows Vista to recover many file extension/suffix and open them in the right program and higly recommend others to try it if they have lost important files.

Always remember to take backup before using these tools.


Tags: , , , ,

Posted by

21 Jan 2009 IP address change notifier script

This is a simple bash script that is run by crontab every 5 minutes on a linux box.
It e-mails me the new address when a change of IP address is detected.

The script (


# Check if IP-address has changed. If a change has occured, mail me the new address
# Add the following line to crontab if you would like it to be run every 5 minutes:
# */5 * * * * ./

# The network interface I want to monitor

# File to keep the latest IP address

# Mail to this address when a change occur

# Read the previous IP address from file
source $IP_FILE

CURRENT_IP=`/sbin/ifconfig $NET_INTERFACE | sed -n "/inet addr:.*255.255.25[0-5].[0-9]/{s/.*inet addr://; s/ .*//; p}"`

if [ "$CURRENT_IP" != "$OLD_IP" ]
        # Send email about address change
        `echo "New IP address detected: $CURRENT_IP" | mail -s "New IP address" $MAILTO`

        # Write new address to file
        `echo "OLD_IP=$CURRENT_IP" > $IP_FILE`

The script can be downloaded here.

Tags: , , ,

Posted by

19 Jan 2009 Mount a RAID Reconstructor disk image in linux

This post came to life because I had gotten a image file of a 120GB linux ext2 RAID partition that I couldn’t access using Windows software. The partition had been rescued by RAID Reconstructor, a Windows software that can rebuild RAID arrays by combining the disks from the RAID and store it as one image file.

The solution was to use linux and try to mount it as a loop filesystem. My assumption was that the partition itself had an unknown offset, so I used this script to search and mount the partition. The script tries to mount the partition within the first 20000 blocks. I assume the block size is 512 bytes and I already know that the partition is formatted as ext2.

for ((i=0 ; $i < 20000 ; i=$i + 1)) ; do
    mount -t ext2 -o loop,offset=$(($i * 512)) diskimage.img /mnt/point && break

If it succeeds you can issue the mount command to get the offset value to the mounted partition

# mount | grep diskimage

/dev/loop0 on /mnt/point type ext2 (rw,offset=32256)

In my case the offset was 32256.

This script can also be used to mount a partition from a backup of your filesystem.

This is my example disk I'm going to create an image of

# fdisk -l

Disk /dev/hda: 80.0 GB, 80026361856 bytes
255 heads, 63 sectors/track, 9729 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/hda1   *           1          14      112423+  83  Linux
/dev/hda2              15          96      658665   83  Linux
/dev/hda3              97        3394    26491185   83  Linux
/dev/hda4            3395        9729    50885887+   f  W95 Ext'd (LBA)
/dev/hda5            3395        7218    30716248+  83  Linux
/dev/hda6            7219        8750    12305758+  83  Linux
/dev/hda7            8751        9533     6289416   83  Linux
/dev/hda8            9534        9729     1574338+  83  Linux

Create a backup image of your entire disk

# dd if=/dev/hda of=imagefile.img

To mount one of these partitions as a loop filesystem you can issue a mount command and tell it the right offset. Use the script above if you don't know the offset, it will take the guesswork for you and mount the partition.

Example of mounting /dev/hda3 if the offset is known

# mount -t ext3 -o loop,offset=49664 /dev/hda3 /mnt/point

Determining the offset is easy when you know the disk geometry have access to the file table.
In this case the hda3 partition has an offset of 512 bytes * 96 blocks = 49664.

This post could have been avoided if I had known about the linux tool TestDisk. testDisk is a powerful free data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table). It could also be used as a forensic tool.

Tags: , , , , ,

Posted by

14 Jan 2009 Resize a VMWare virtual disk

This post describes how you can resize your VMWare disk in linux using the vmware-vdiskmanager tool, a offline disk manipulation utility.
I’ve been using VMWare Workstation version 6.5 on a Ubuntu 8.10 Intrepid Ibex linux installation.

Shrink a disk image

vmware-vdiskmanager -k diskname.vmdk

Expand the disk to the specified capacity

vmware-vdiskmanager -x <new-capacity> diskimage.vmdk

Example extend a disk to 120GB

vmware-vdiskmanager -x 120GB diskimage.vmdk

You should use a Live-CD or something to resize/expand the filesystem to fill the extended disk. I used gparted on a Ubuntu Live-CD and the operation var quick and painless.

Only local virtual disks may be expanded og shrinked and these features are unavailable if you have used the Snapshot functionality. If you have made a Snapshot, then I recommend creating a clone of the system and then resize the cloned image disk.

Always remember to backup your virtual machine before doing this operation.

Tags: ,

Posted by

08 Jan 2009 Vmware Workstation 6.5 On Ubuntu 8.10 Modifiers Keys Not Working

This post describes a quick fix to enable arrow, delete, ins, end and other special keyboard keys in a VMWare Workstation 6.5 for linux like the norwegian/norske letters/bokstavene ÆØÅ.

Solution #1

echo 'xkeymap.nokeycodeMap = true' > ~/.vmware/config 

This has been tested successfully on Windows hosts.

Solution #2
Another solution is to paste the following code into ~/.vmware/config

xkeymap.keycode.108 = 0x138 # Alt_R
xkeymap.keycode.106 = 0x135 # KP_Divide
xkeymap.keycode.104 = 0x11c # KP_Enter
xkeymap.keycode.111 = 0x148 # Up
xkeymap.keycode.116 = 0x150 # Down
xkeymap.keycode.113 = 0x14b # Left
xkeymap.keycode.114 = 0x14d # Right
xkeymap.keycode.105 = 0x11d # Control_R
xkeymap.keycode.118 = 0x152 # Insert
xkeymap.keycode.119 = 0x153 # Delete
xkeymap.keycode.110 = 0x147 # Home
xkeymap.keycode.115 = 0x14f # End
xkeymap.keycode.112 = 0x149 # Prior
xkeymap.keycode.117 = 0x151 # Next
xkeymap.keycode.78 = 0x46 # Scroll_Lock
xkeymap.keycode.127 = 0x100 # Pause
xkeymap.keycode.133 = 0x15b # Meta_L
xkeymap.keycode.134 = 0x15c # Meta_R
xkeymap.keycode.135 = 0x15d # Menu

This code comes instead of the line added in Solution #1.

The solution was found on the VMWare Forums in a thread named Keyboard in bad shape with Workstation 6.5 running under Ubuntu Intrepid 8.10
Another interesting page about this problem can be found on

Tags: ,

Posted by