If looking at the block layer, would seeing the growth in size of a snapshot volume work?
I know with Linux LVM2, the snapshot volume holds the original copy of a changed block. So, any block changed would show up in the snapshot volume. So, you then have some record (though I don't know how easy it would be to get to) of blocks updated since the snapshot was taken. On 01/17/11 12:15, Aaron McCaleb wrote: > All, > > Again, thanks for the feedback. I did ask some data forensics folks > for a different perspecitve, but they would typically clone a drive, > then run checksums (which would interfere with 'atime' data.), or > would create a map of the last change date of all of the file sectors, > then diff that with a later map to just see the differences. At least > that's how I understand the process as described. > > Basically, all that might be well suited to consumer-grade data > storage, but not so easy with large RAID filesystems. > > Thanks for the input, everyone. > _______________________________________________ > Tech mailing list > [email protected] > https://lists.lopsa.org/cgi-bin/mailman/listinfo/tech > This list provided by the League of Professional System Administrators > http://lopsa.org/ -- END OF LINE --MCP _______________________________________________ Tech mailing list [email protected] https://lists.lopsa.org/cgi-bin/mailman/listinfo/tech This list provided by the League of Professional System Administrators http://lopsa.org/
