[zfs-code] Start of the MOS

Hi Am not sure who to address this query to, there is no list for ZFS forensics (yet). I'm looking at a DD dump of a VTOC partition containing a ZFS test file system, follow the Uberblock DVAs to 3 separate locations (ditto blocks, as expected) but don't find an object I can recognise. It shoul

[zfs-code] On disk layout of a ZFS file system

can't see quite how it is encapsulated as an object, either, since it is larger than a 128kb block. Any tips for reading re. code files would be appreciated. Regards Mark On Monday 30 July 2007 20:51, Mark Furner (Mark Furner ) may have written: > Hi > > Despite having

[zfs-code] On disk layout of a ZFS file system

ere is the file data? Can you point me in the direction of the relevant code passages? Any help would save time with the hex editor... Thanks a lot Mark On Saturday 28 July 2007 00:35, Matthew Ahrens may have written: > Mark Furner wrote: > > Thanks for the clarification, Darren, and

[zfs-code] Read-only (forensic) mounts of ZFS

Thanks! Mark On Saturday 28 July 2007 00:35, Matthew Ahrens may have written: > Mark Furner wrote: > > Thanks for the clarification, Darren, and sorry for cross-posting. > > > > OK, physical device -> pool -> file-system(s) > > > > Some questions: > &g

[zfs-code] Read-only (forensic) mounts of ZFS

, Darren J Moffat may have written: > Mark Furner wrote: > > Thanks for the clarification, Darren, and sorry for cross-posting. > > > > OK, physical device -> pool -> file-system(s) > > > > Some questions: > > > > 1) zpool import allows options sim

[zfs-code] Read-only (forensic) mounts of ZFS

July 2007 11:37, Darren J Moffat may have written: > Mark Furner wrote: > > PREPARE LOOPBACK DEVICE > > note need full path for file > > > > root at sol10 /export/home# lofiadm -a /export/home/t1_fs1.COPY.dd > > /dev/lofi/1 root at sol10 /export/home# lofiadm

[zfs-code] Read-only (forensic) mounts of ZFS

Hi I'm looking into forensic aspects of ZFS, in particular ways to use ZFS tools to investigate ZFS file systems without writing to the pools. I'm working on a test suite of file system images within VTOC partitions. At the moment, these only have 1 file system per pool per VTOC partition for

[zfs-code] ZFS file system history log and zpool.cache

Thanks again Eric. Lots of food for thought here, so much head scratching I'll get dandruff... Mark On Wednesday 25 July 2007 20:30, Eric Schrock (Eric Schrock ) may have written: > On Wed, Jul 25, 2007 at 08:19:07PM +0200, Mark Furner wrote: > > Many thanks for the quick reply

[zfs-code] ZFS file system history log and zpool.cache

he files / file metadata / directories begin? Regards Mark On Wednesday 25 July 2007 18:08, Eric Schrock (Eric Schrock ) may have written: > On Wed, Jul 25, 2007 at 01:11:54PM +0200, Mark Furner wrote: > > * ZFS has a legacy mode where mounts are handled by /etc/vfstab or a > > d

[zfs-code] ZFS file system history log and zpool.cache

Hello I'm looking into the forensic artefacts of ZFS and came across zpool.cache in /etc/zfs/. Can some wise person confirm my information is correct and help me with some questions? I've had a look through the code on src.opensolaris.org and the On Disk specs (the PDF document ZFS On-Disk Spe