[Top] [All Lists]

Re: xfs_bmbt_rec_64 leading to wrong blocks

To: Brian Foster <bfoster@xxxxxxxxxx>
Subject: Re: xfs_bmbt_rec_64 leading to wrong blocks
From: Felipe Monteiro de Carvalho <felipemonteiro.carvalho@xxxxxxxxx>
Date: Thu, 7 Aug 2014 13:51:01 +0200
Cc: xfs@xxxxxxxxxxx
Delivered-to: xfs@xxxxxxxxxxx
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=bM0spycRMLx+DsVaZkUmPNpGZ0onAta8E92SORAlvMY=; b=0Q4gc7yPtgJE75KdYeajeFhIY8iaga1D+VuNJKzsxegZvSbRk72/3JFiOevLkgkUVt J8Pnf0jWA3UIr4gBTIYxLI/oteMs+1YbhU4vEw4hK/JX4tcRG6Foi0rPtmf+oQ3ye5o3 BWkrgIrFawySlrEvE6psUhtSCjXy/Q9xo+Rdw7zPuu64vLnotEEx9YsZSZ1BWxtO2pyR /1K6NuO3+tPSDjzgolq7y8yGhHy1dA4cKJe1Cb79uKIrYIqQ2JSIYyQ2TVebN9azIVJh K2MiQMSgcnInPfm7UWQkyR+fLIur2U4e5igmhDv+SWD/ZDkhk9zZh/rPYh6b91IpO6Qb pKsg==
In-reply-to: <20140806142329.GA39990@xxxxxxxxxxxxxxx>
References: <CACyNnZM8D4ZdOAvbXNoiRUAGh1uZF8=9Gy34qS2XH7QUVjiGsQ@xxxxxxxxxxxxxx> <20140806113447.GA14820@xxxxxxxxxxxxxxx> <CACyNnZNwCPw8dsyRKSty7GPp4DxAd7ycHuztsC-VAdGEmjdnyw@xxxxxxxxxxxxxx> <20140806142329.GA39990@xxxxxxxxxxxxxxx>

Thanks, that worked perfectly =)

My actual idea is to not only read the partition, but to also recover
deleted/corrupted files. With the information that you provided I
advanced a lot in this direction, and I can now recover the file
information in that memory area completely. I can also obtain the
inode nr (well 4 bytes of it are preserved, but its better then
nothing), but my current problem is with the inode itself. In a
deleted file the following changes are done by the linux driver in the

xfs_dinode_core_t.di_mode was changed to zero
xfs_dinode_core_t.di_format was changed from 1 (local) to 2 (extent)

But di_mode in particular is a key element as I am using it to
differentiate files from directories.

Is there anything else what I can use to differentiate files from
directories in case di_mode was corrupted? I am searching here but so
far I didn't find anything...

Felipe Monteiro de Carvalho

<Prev in Thread] Current Thread [Next in Thread>