[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [dm-devel] DM_snapshot_cow filesystem (dmsetup create snapshot)



On 11/27/2011 04:31 PM, Frederick Grose wrote:
On Sat, Oct 29, 2011 at 4:49 PM, Alasdair G Kergon <agk redhat com
<mailto:agk redhat com>> wrote:

    markmc did some code that shows how to read the format a few years
    ago here:
    http://people.gnome.org/~markmc/code/merge-dm-snapshot.c
    <http://people.gnome.org/%7Emarkmc/code/merge-dm-snapshot.c>

    Otherwise look at dm-snap-persistent.c in the kernel tree.

    Alasdair


Users can easily exhaust a LiveUSB snapshot overlay by writing
too many changes to the OS filesystem, such as by performing
a yum update.

Would such an 'exhausted' overlay be amenable to some sort of
data recovery or forensics?

If so, how so; if not, why not?

Can you not mount the exhausted dm snapshot? If you mean data recovery or forensics beyond that, please elaborate.

I know I've had issues 'read-only' mounting ext3(2?3?4?) filesystems before (on actually read-only block devices). Maybe some flags that I've forgotten get past that, but worst case you can always fake a writable device with a 2nd overlay/snapshot going to a writable device, i.e. if you wanted to let fsck repair things.

-dmc


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]