On Thu, Aug 07, 2014 at 01:51:01PM +0200, Felipe Monteiro de Carvalho wrote:
> Thanks, that worked perfectly =)
> My actual idea is to not only read the partition, but to also recover
> deleted/corrupted files. With the information that you provided I
> advanced a lot in this direction, and I can now recover the file
> information in that memory area completely. I can also obtain the
> inode nr (well 4 bytes of it are preserved, but its better then
> nothing), but my current problem is with the inode itself. In a
> deleted file the following changes are done by the linux driver in the
> xfs_dinode_core_t.di_mode was changed to zero
> xfs_dinode_core_t.di_format was changed from 1 (local) to 2 (extent)
These are set in xfs_ifree() when the inode is pulled from the unlinked
list and ultimately freed. Resetting these values certainly makes sense,
but I'm not aware of the reason why di_format is set as such.
> But di_mode in particular is a key element as I am using it to
> differentiate files from directories.
In general you can't rely on on-disk data once the inode has been freed.
Perhaps you should start a new thread with some kind of write up about
what you're trying to accomplish and how you're going about it.
> Is there anything else what I can use to differentiate files from
> directories in case di_mode was corrupted? I am searching here but so
> far I didn't find anything...
> Felipe Monteiro de Carvalho
> xfs mailing list