Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 16 Jun 2016 16:56:21 +0200
From:      cpghost <cpghost@cordula.ws>
To:        FreeBSD Questions <freebsd-questions@freebsd.org>
Subject:   ZFS forensics (mapping sector # to file name)
Message-ID:  <2b478742-ba3a-7f05-56ea-88f6aca1a9db@cordula.ws>

Next in thread | Raw E-Mail | Index | Archive | Help
Hello ZFS gurus/admins,

how do you map a sector # to a ZFS object? Or, more concretely:

Suppose I'm inspecting a disk /dev/ada0p4[.eli] that belongs to a
zpool, and there's something interesting in sector #123456. How do
I determine to which file, directory, etc... on which ZFS dataset
this sector belongs, or if this sector belongs to a deleted file
(unallocated sector), or to something that was there all along before
the disk got reformatted to ZFS?

Any ideas? Forensics tools?

Thanks,

-cpghost.

-- 
Cordula's Web. http://www.cordula.ws/



Want to link to this message? Use this URL: <http://docs.FreeBSD.org/cgi/mid.cgi?2b478742-ba3a-7f05-56ea-88f6aca1a9db>