Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 16 Jun 2016 16:56:21 +0200
From:      cpghost <>
To:        FreeBSD Questions <>
Subject:   ZFS forensics (mapping sector # to file name)
Message-ID:  <>

Next in thread | Raw E-Mail | Index | Archive | Help
Hello ZFS gurus/admins,

how do you map a sector # to a ZFS object? Or, more concretely:

Suppose I'm inspecting a disk /dev/ada0p4[.eli] that belongs to a
zpool, and there's something interesting in sector #123456. How do
I determine to which file, directory, etc... on which ZFS dataset
this sector belongs, or if this sector belongs to a deleted file
(unallocated sector), or to something that was there all along before
the disk got reformatted to ZFS?

Any ideas? Forensics tools?



Cordula's Web.

Want to link to this message? Use this URL: <>