Recovering forensic data from a failed boot

[Joe Zeff]

On 01/30/2012 01:38 PM, jdow wrote:
> First one must take a dd level record of the infected disk(s).

The disk isn't infected.  It just won't boot into any 3.x kernel, but 
boots fine with the last kernel from F14.

I do, however, have a little more data: ever since the "upgrade," my 
laptop's been unable to mount CD/DVD discs although it never had any 
trouble under F14.  If I put a DVD into the drive and try to reboot to a 
3.x kernel, instead of getting error messages about the sdb cache, I get 
errors about not being able to read the disc.  For some reason, the 3.x 
kernels are trying to read from that drive even when it's empty, and 
hanging because it can't.  I doubt it's something in the BIOS, or boot 
order, because the old 2.x kernel has no trouble booting, even though it 
can't read from the drive any more either.