[Top] [All Lists]

Re: Hello, I have a question about XFS File System

To: Shaun Gosse <sgosse@xxxxxxx>, Yongmin <dev.yongmin@xxxxxxxxx>, "xfs@xxxxxxxxxxx" <xfs@xxxxxxxxxxx>
Subject: Re: Hello, I have a question about XFS File System
From: Stan Hoeppner <stan@xxxxxxxxxxxxxxxxx>
Date: Fri, 07 Mar 2014 20:22:09 -0600
Delivered-to: xfs@xxxxxxxxxxx
In-reply-to: <8D3FA7645C1CFC4E9E783D22B4C708647305E1F5@xxxxxxxxxxxxxxxxxxxxxxxxx>
References: <195DE8C60CE24A62A71911FDE0B0DC97@xxxxxxxxx> <5318DB01.2040102@xxxxxxxxxxxxxxxxx> <279D0A265E5D4AF5B099BFAD4E8B1700@xxxxxxxxx> <531A4600.7050906@xxxxxxxxxxxxxxxxx> <8D3FA7645C1CFC4E9E783D22B4C708647305E1F5@xxxxxxxxxxxxxxxxxxxxxxxxx>
Reply-to: stan@xxxxxxxxxxxxxxxxx
User-agent: Mozilla/5.0 (Windows NT 5.1; rv:24.0) Gecko/20100101 Thunderbird/24.3.0
On 3/7/2014 4:40 PM, Shaun Gosse wrote:
> Stan,
> If I understand what you're saying here correctly, it sounds like
> there would still be a very tiny window where the journal could be
> relevant, those "few seconds" before it's committed as you said. So
> it would be a rather small corner case, but there might be some use.
> And I think it was already stated to be an academic project...

It could be in the log for milliseconds, many minutes, hours, or even
days, or months, depending on the rate of metadata write activity.  XFS
is still primarily for "large and lots".  Most organizations using XFS
probably don't have idle journal logs, but very active ones.

> This does makes me curious in turn about how difficult it would be to
> recover journal entries. At a guess, if a person knows the structure
> and it hasn't been overwritten, it'll still be there? Or is it
> automatically overwritten/zero'd when the entry is removed from the
> journal, perhaps as the very mechanism of removal? And presumably
> this window, if any, would also be rather small assuming an active
> filesystem (and an inactive one presumably irrelevant...unless,
> perhaps, it was one where the last action, arbitrarily long ago, was
> a critical delete operation...).

How often are forensics experts brought in within minutes, hours, or
days of an incident of such magnitude prompting them to be hired?
Forensics is typically performed long after the fact, in which case
there's almost zero chance any relevant information will be in the
filesystem journal.


<Prev in Thread] Current Thread [Next in Thread>