Hi Roberto, Thanks for your report. I tested ext4magic over Debian Unstable now and the problem also occurs.
I applied your patch and uploaded a new package to unstable. When in testing (five days), I will upload to Jessie-Backports. To close this bug, I will wait a final solution. Thanks a lot in advance. Regards, Eriberto 2015-10-17 10:45 GMT-03:00 Roberto Maar <ro...@users.sf.net>: > Package: ext4magic > Version: 0.3.2-2 > Severity: normal > > Dear Maintainer, > > ext4magic has a misinterpretation of the physical block addresses and block > lengths of ext4 inode. > With each call by ext4magic be other random and too large values dertermined. > Thus, a recover from ext4 file system is not possible. > The error is permanent and 100% reproducible (also on i386) > Often with the additional warning: "error-NR 22 can not found file" > > > Example: > > # ext4magic -T -I2 -x /dev/sdb1 #debian 8.2 (amd64) > .... > Dump Inode 2 from journal transaction 0 > Inode: 2 Type: directory Mode: 0755 Flags: 0x80000 > Generation: 0 Version: 0x00000000:00000004 > User: 0 Group: 0 Size: 4096 > File ACL: 0 Directory ACL: 0 > Links: 5 Blockcount: 8 > Fragment: Address: 0 Number: 0 Size: 0 > ctime: 1444944845:3712000000 -- Thu Oct 15 23:34:05 2015 > atime: 1444944255:1968000000 -- Thu Oct 15 23:24:15 2015 > mtime: 1444944845:3712000000 -- Thu Oct 15 23:34:05 2015 > crtime: 1444943306:0000000000 -- Thu Oct 15 23:08:26 2015 > Size of extra inode fields: 28 > Level Entries Logical Physical Length Flags > 0/ 0 1/ 1 0 - 25855 89219572695840 - 89219572721695 25856 > ...... > The block length 25855 and the start block 89219572695840 are random values > and the false block data would also be used while trying a recover. > > > > The correct output should be: #OpenSuse 13.1 (x86-64) > ...... > Dump Inode 2 from journal transaction 0 > Inode: 2 Type: directory Mode: 0755 Flags: 0x80000 > Generation: 0 Version: 0x00000000:00000004 > User: 0 Group: 0 Size: 4096 > File ACL: 0 Directory ACL: 0 > Links: 5 Blockcount: 8 > Fragment: Address: 0 Number: 0 Size: 0 > ctime: 1444944845:3712000000 -- Thu Oct 15 23:34:05 2015 > atime: 1444944255:1968000000 -- Thu Oct 15 23:24:15 2015 > mtime: 1444944845:3712000000 -- Thu Oct 15 23:34:05 2015 > crtime: 1444943306:0000000000 -- Thu Oct 15 23:08:26 2015 > Size of extra inode fields: 28 > Level Entries Logical Physical Length Flags > 0/ 0 1/ 1 0 - 0 8865 - 8865 1 > 2 d 755 (2) 0 0 4096 15-Oct-2015 23:08 . > 2 d 755 (2) 0 0 4096 15-Oct-2015 23:08 .. > 11 d 700 (2) 0 0 16384 15-Oct-2015 23:08 > lost+found > 393217 d 755 (2) 0 0 12288 15-Oct-2015 23:04 etc > < 131073> d 755 (2) 0 0 65536 15-Oct-2015 23:20 doc > 524289 d 755 (2) 0 0 4096 15-Oct-2015 22:51 help > ....... > > See also Ticket #3 on ext4magic sf.net site. > > > -- System Information: > Debian Release: 8.2 > APT prefers stable-updates > APT policy: (500, 'stable-updates'), (500, 'stable') > Architecture: amd64 (x86_64) > > Kernel: Linux 3.16.0-4-amd64 (SMP w/2 CPU cores) > Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8) > Shell: /bin/sh linked to /bin/dash > Init: systemd (via /run/systemd/system) > > Versions of packages ext4magic depends on: > ii e2fslibs 1.42.12-1.1 > ii libblkid1 2.25.2-6 > ii libbz2-1.0 1.0.6-7+b3 > ii libc6 2.19-18+deb8u1 > ii libmagic1 1:5.22+15-2 > ii libuuid1 2.25.2-6 > ii zlib1g 1:1.2.8.dfsg-2+b1 > > ext4magic recommends no packages. > > ext4magic suggests no packages. > > -- no debconf information > > _______________________________________________ > forensics-devel mailing list > forensics-de...@lists.alioth.debian.org > http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/forensics-devel