[Nottingham] Forensics problem (XFS)

Martin martin at ml1.co.uk
Wed Sep 15 11:01:38 UTC 2010

On 15/09/10 08:25, Mat Booth wrote:
> On 15 September 2010 00:47, Martin <martin at ml1.co.uk> wrote:
>> On 14/09/10 20:07, Paul Tew wrote:
>>> On Tue, 2010-09-14 at 17:13 +0100, Martin wrote:
>>>> There must be some debug utility for checking/doing that...
>>> and it's name is?
>> That's where this maillist hopefully magics up the magic answer!
> Shazam!
> http://mailman.lug.org.uk/pipermail/nottingham/2010-September/013564.html
> ;-)

More like a "Voila"!

I ain't got the man page on any of my systems, but by the power of the web:

( Abracadabra :-) )


Looks comprehensive for exploring all and everything about an xfs image.
Two quick teasers from viewing the location stack:


View the location stack:


This section gives the fields in each structure type and their meanings.)


[leaf blocks only] array of extent records. Each record contains
startoff, startblock, blockcount, and extentflag (1 if the extent is


[leaf blocks only] array of freespace records. Each record contains
startblock and blockcount."

I rather the option for randomly trashing a few blocks to test recovery!

All by the power of the maillist!


Martin Lomas
martin at ml1.co.uk

More information about the Nottingham mailing list