[Nottingham] Forensics problem (XFS)

[Martin]

On 15/09/10 08:25, Mat Booth wrote:
> On 15 September 2010 00:47, Martin <martin at ml1.co.uk> wrote:
>> On 14/09/10 20:07, Paul Tew wrote:
>>> On Tue, 2010-09-14 at 17:13 +0100, Martin wrote:
>>>> There must be some debug utility for checking/doing that...
>>>
>>> and it's name is?
>>
>> That's where this maillist hopefully magics up the magic answer!
>>
> 
> Shazam!
> 
> http://mailman.lug.org.uk/pipermail/nottingham/2010-September/013564.html
> 
> ;-)

More like a "Voila"!

I ain't got the man page on any of my systems, but by the power of the web:

( Abracadabra :-) )

http://linux.die.net/man/8/xfs_db

Looks comprehensive for exploring all and everything about an xfs image.
Two quick teasers from viewing the location stack:

stack

View the location stack:

(Types

This section gives the fields in each structure type and their meanings.)

"recs

[leaf blocks only] array of extent records. Each record contains
startoff, startblock, blockcount, and extentflag (1 if the extent is
unwritten)."

"recs

[leaf blocks only] array of freespace records. Each record contains
startblock and blockcount."


I rather the option for randomly trashing a few blocks to test recovery!


All by the power of the maillist!

Cheers,
Martin


-- 
----------------
Martin Lomas
martin at ml1.co.uk
----------------