[Top] [All Lists]

Re: 128 bits extent bmap for file format 2

To: Pradeep Kumar <praks411@xxxxxxxxx>,xfs@xxxxxxxxxxx
Subject: Re: 128 bits extent bmap for file format 2
From: Greg Freemyer <greg.freemyer@xxxxxxxxx>
Date: Tue, 22 Oct 2013 09:11:06 -0400
Delivered-to: xfs@xxxxxxxxxxx
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=user-agent:in-reply-to:references:mime-version:content-type :content-transfer-encoding:subject:from:date:to:message-id; bh=qiSz3XpWDlq9Aj6VsAKSNBd2lUg3DHsse2I4PtEPBRw=; b=LtI3UDhD7Ala78Ez7he8nkxYZRyLWVWvxoTU4NaHCSqzMnhEI43G0igC6G+228a/2A j18syPNjbVFTj+jZFAuM6sKfsBQxGht2RnDkC2XhTPfXPbjsgufcH725wqpd3UANmvlB wkbe7HSMnV+Bk3qup2Roqb85Bq7DczqO01jrA1Qq4SuA3dM3TyBOBAGklU+kUXe5ZW1D VHrxqyeb1BA74Qwn5QA2JjJtPR7w/bvvziEcos2cf4aEUALd87XChdhQpLWwf1rn85eq dklX1PVeZRpox++VQEaWYxfaZTuxUqoegf41LJWvPFvgqQU0miP1gmeLYX5cIChk7Upu 5ufg==
In-reply-to: <CAPU9cc3rV+E79HBE95=nsjgoC5=s85jBBZgcxL+d8KijVa0LyA@xxxxxxxxxxxxxx>
References: <CAPU9cc3rV+E79HBE95=nsjgoC5=s85jBBZgcxL+d8KijVa0LyA@xxxxxxxxxxxxxx>
User-agent: K-9 Mail for Android

Pradeep Kumar <praks411@xxxxxxxxx> wrote:
>I'm writing a small utility to parse XFS fs image on windows.
>I'm able to fetch the files in the first AG (0).
>However when it comes to the files which are in different AG I'm facing
>some problem in parsing extent bmap 128bits data of file inode (format
>Here is the sample 128bits data
>1. 00 00 00 00 00 00 00 00 00 00 00 04 99 80 00 01 (LSB)
>After unpacking the bits are per doc and source code
>In the above case I'm getting following
>Num Of blocks = 1 (correct) (0 to 20 bits)
>absolute block number = 9420 (0x24CC) (wrong) (21 to 72)
>file offset = 0 (72 to 126)
>I'm always getting wrong absolute block number . Actual data is in
>7628 (0x1DCC).
>No matter what I try I'm always getting the same result. I've even
>by using the code from xfs_bmbt_get_all function from xfs source which
>gives me same result (9420).
>Please someone help me with this. I'm stuck on this from 3 days.
>Thanks and Regards,


It would be cool if your utility could be incorporated into sleuthkit.  
Sleuthkit has fat and NTFS parsers for sure already.  I think ext2 and ext3.  
Adding a xfs parser would be a cool addition.


Fyi: sleuthkit has been around for a long time, but it is still actively 
maintained and heavily used.  It is in several linux distros, but is also 
available for windows.

Sent from my Android phone with K-9 Mail. Please excuse my brevity.

<Prev in Thread] Current Thread [Next in Thread>