128 bits extent bmap for file format 2

[Pradeep Kumar]

Hi Greg,

This could be nice addition. I will try to submit it once done.

Pradeep


On 22 October 2013 15:11, Greg Freemyer <greg.freemyer at gmail.com> wrote:

>
>
> Pradeep Kumar <praks411 at gmail.com> wrote:
> >Hi,
> >
> >I'm writing a small utility to parse XFS fs image on windows.
> >I'm able to fetch the files in the first AG (0).
> >However when it comes to the files which are in different AG I'm facing
> >some problem in parsing extent bmap 128bits data of file inode (format
> >==
> >2).
> >
> >Here is the sample 128bits data
> >1. 00 00 00 00 00 00 00 00 00 00 00 04 99 80 00 01 (LSB)
> >
> >After unpacking the bits are per doc and source code
> >In the above case I'm getting following
> >Num Of blocks = 1 (correct) (0 to 20 bits)
> >absolute block number = 9420 (0x24CC) (wrong) (21 to 72)
> >file offset = 0 (72 to 126)
> >
> >I'm always getting wrong absolute block number . Actual data is in
> >block
> >7628 (0x1DCC).
> >No matter what I try I'm always getting the same result. I've even
> >verified
> >this
> >by using the code from xfs_bmbt_get_all function from xfs source which
> >too
> >gives me same result (9420).
> >Please someone help me with this. I'm stuck on this from 3 days.
> >
> >Thanks and Regards,
> >Pradeep
>
> Pradeep,
>
> It would be cool if your utility could be incorporated into sleuthkit.
>  Sleuthkit has fat and NTFS parsers for sure already.  I think ext2 and
> ext3.  Adding a xfs parser would be a cool addition.
>
>  http://www.sleuthkit.org/sleuthkit/docs/api-docs/index.html#users_guide
>
> Fyi: sleuthkit has been around for a long time, but it is still actively
> maintained and heavily used.  It is in several linux distros, but is also
> available for windows.
>
> Greg
> --
> Sent from my Android phone with K-9 Mail. Please excuse my brevity.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://oss.sgi.com/pipermail/xfs/attachments/20131103/33f52efb/attachment.html>