Date: Thu, 16 Jun 2016 16:56:21 +0200 From: cpghost <cpghost@cordula.ws> To: FreeBSD Questions <freebsd-questions@freebsd.org> Subject: ZFS forensics (mapping sector # to file name) Message-ID: <2b478742-ba3a-7f05-56ea-88f6aca1a9db@cordula.ws>
next in thread | raw e-mail | index | archive | help
Hello ZFS gurus/admins, how do you map a sector # to a ZFS object? Or, more concretely: Suppose I'm inspecting a disk /dev/ada0p4[.eli] that belongs to a zpool, and there's something interesting in sector #123456. How do I determine to which file, directory, etc... on which ZFS dataset this sector belongs, or if this sector belongs to a deleted file (unallocated sector), or to something that was there all along before the disk got reformatted to ZFS? Any ideas? Forensics tools? Thanks, -cpghost. -- Cordula's Web. http://www.cordula.ws/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?2b478742-ba3a-7f05-56ea-88f6aca1a9db>