xfs_bmbt_rec_64 leading to wrong blocks

[Brian Foster]

On Thu, Aug 07, 2014 at 01:51:01PM +0200, Felipe Monteiro de Carvalho wrote:
> Hello,
> 
> Thanks, that worked perfectly =)
> 
> My actual idea is to not only read the partition, but to also recover
> deleted/corrupted files. With the information that you provided I
> advanced a lot in this direction, and I can now recover the file
> information in that memory area completely. I can also obtain the
> inode nr (well 4 bytes of it are preserved, but its better then
> nothing), but my current problem is with the inode itself. In a
> deleted file the following changes are done by the linux driver in the
> inode:
> 
> xfs_dinode_core_t.di_mode was changed to zero
> xfs_dinode_core_t.di_format was changed from 1 (local) to 2 (extent)
> 

These are set in xfs_ifree() when the inode is pulled from the unlinked
list and ultimately freed. Resetting these values certainly makes sense,
but I'm not aware of the reason why di_format is set as such.

> But di_mode in particular is a key element as I am using it to
> differentiate files from directories.
> 

In general you can't rely on on-disk data once the inode has been freed.
Perhaps you should start a new thread with some kind of write up about
what you're trying to accomplish and how you're going about it.

Brian

> Is there anything else what I can use to differentiate files from
> directories in case di_mode was corrupted? I am searching here but so
> far I didn't find anything...
> 
> thanks,
> -- 
> Felipe Monteiro de Carvalho
> 
> _______________________________________________
> xfs mailing list
> xfs at oss.sgi.com
> http://oss.sgi.com/mailman/listinfo/xfs