> On Fri, 2006-10-20 at 09:44 +0200, [EMAIL PROTECTED] wrote:
>
>> I now have a semi-working program that can extract files with filenames
>> and paths. I am test-driving it on a healthy jfs-image. It does not work
>> that relaible yet. So, heres my questions:
>>
>> Does an inode-extent _always_ consist of 32 consecutive inodes, with
>> consecutive di_number?
>
> Yes
>
>> The reason I ask is that I found inodes, that seems
>> to be valid, but which are parts of a much smaller extent (5-25inos or
>> so). Is this possible?
>
> I'm not sure how. If a freed inode extent is partially reused, I would
> expect entire 4K pages to be overwritten, leaving you with 8 or 16
> inodes together, probably all with di_nlink == 0.
>
>> It might also be due to that neighbouring inodes,
>> that should have been a part of the extent, failed the sanity-check
>> (mentioned elseware in this thread).
>
> The extent will contain both allocated and unallocated inodes. For both
> of these, di_inostamp should be the same, di_number should be valid, and
> di_fileset should be 16. di_nlink being non-zero indicates that the
> inode is allocated.
>
It was the unallocated inodes that fooled me. When I take them into
account its no problem to detect inode extents. I guess this is quite a
good filter.
The program does check for duplicate di_numbers, and I am not sure what to
do with these duplicates. The di_number must be unique in the inode set to
be recovered (or else its impossible to decide which inode whould be used
as parent etc.). But how do I choose which inode to keep of two, seemingly
sane, but not identical, inodes? I will attach an example at the end of
this mail.
How do I detect which inode that was the original root? In normal cases I
get a set of orphaned trees, but one of this should be the original root.
In the filesystems I have tried it seems that the inode with di_number ==
2 is the root. Is that always true?
The program slowly progresses towards something that might be usable by
others than me. I would be very happy with releasing it under the GPL or
some other open source license. But, as I have copied some code from xpeek
I'm not sure weather it is possible. The program is not based on anything
from any jfs package, its only parts from xpeek that has been copied and
modified (the extent walk for instance).
Best regards,
Simon
I have no idea why these two inodes have the same di_number. They also
have the same inostamp.
Non-unique di_number found! 680576
[1] di_inostamp: 0x44da3d75 [19] di_mtime.tv_nsec: 0x00000000
[2] di_fileset: 16 [20] di_otime.tv_sec: 0x45072082
[3] di_number: 680576 [21] di_otime.tv_nsec: 0x00000000
[4] di_gen: 7214231 [22] di_acl.flag: 0x00
[5] di_ixpxd.len: 4 [23] di_acl.rsrvd: Not Displayed
[6] di_ixpxd.addr1: 0x00 [24] di_acl.size: 0x00000000
[7] di_ixpxd.addr2: 0x000925e8 [25] di_acl.len: 0
di_ixpxd.address: 599528 [26] di_acl.addr1: 0x00
[8] di_size: 0x0000000000001000 [27] di_acl.addr2: 0x00000000
[9] di_nblocks: 0x0000000000000002 di_acl.address: 0
[10] di_nlink: 2 [28] di_ea.flag: 0x00
[11] di_uid: 0 [29] di_ea.rsrvd: Not Displayed
[12] di_gid: 0 [30] di_ea.size: 0x00000000
[13] di_mode: 0x200041ed [31] di_ea.len: 0
[32] di_ea.addr1: 0x00
[14] di_atime.tv_sec: 0x45072082 [33] di_ea.addr2: 0x00000000
[15] di_atime.tv_nsec: 0x00000000 di_ea.address: 0
[16] di_ctime.tv_sec: 0x45072087 [34] di_next_index: 27
[17] di_ctime.tv_nsec: 0x234a7068 [35] di_acltype: 0x00000000
[18] di_mtime.tv_sec: 0x45072085
[1] di_inostamp: 0x44da3d75 [19] di_mtime.tv_nsec: 0x00000000
[2] di_fileset: 16 [20] di_otime.tv_sec: 0x44dfbb92
[3] di_number: 680576 [21] di_otime.tv_nsec: 0x00000000
[4] di_gen: 1703739 [22] di_acl.flag: 0x00
[5] di_ixpxd.len: 4 [23] di_acl.rsrvd: Not Displayed
[6] di_ixpxd.addr1: 0x00 [24] di_acl.size: 0x00000000
[7] di_ixpxd.addr2: 0x000c507c [25] di_acl.len: 0
di_ixpxd.address: 807036 [26] di_acl.addr1: 0x00
[8] di_size: 0x0000000000000010 [27] di_acl.addr2: 0x00000000
[9] di_nblocks: 0x0000000000000000 di_acl.address: 0
[10] di_nlink: 2 [28] di_ea.flag: 0x00
[11] di_uid: 1000 [29] di_ea.rsrvd: Not Displayed
[12] di_gid: 100 [30] di_ea.size: 0x00000000
[13] di_mode: 0x200041ed [31] di_ea.len: 0
[32] di_ea.addr1: 0x00
[14] di_atime.tv_sec: 0x44dfc505 [33] di_ea.addr2: 0x00000000
[15] di_atime.tv_nsec: 0x00000000 di_ea.address: 0
[16] di_ctime.tv_sec: 0x44dfc505 [34] di_next_index: 4
[17] di_ctime.tv_nsec: 0x1185292c [35] di_acltype: 0x00000000
[18] di_mtime.tv_sec: 0x44d2c8db
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Jfs-discussion mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/jfs-discussion
