Date: Tue, 14 Apr 2009 22:07:42 +0200 From: cpghost <cpghost@cordula.ws> To: Roland Smith <rsmith@xs4all.nl> Cc: freebsd-questions@freebsd.org Subject: Re: Block device to regular file? Message-ID: <20090414200741.GA81984@phenom.cordula.ws> In-Reply-To: <20090414193622.GA33883@slackbox.xs4all.nl> References: <20090414161724.GA3721@phenom.cordula.ws> <20090414191843.c32e7f93.freebsd@edvax.de> <20090414174816.GA80513@phenom.cordula.ws> <20090414193622.GA33883@slackbox.xs4all.nl>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Apr 14, 2009 at 09:36:22PM +0200, Roland Smith wrote: > On Tue, Apr 14, 2009 at 07:48:16PM +0200, cpghost wrote: > > On Tue, Apr 14, 2009 at 07:18:43PM +0200, Polytropon wrote: > > > On Tue, 14 Apr 2009 18:17:24 +0200, cpghost <cpghost@cordula.ws> wrote: > > > > I'm trying to recover some deleted files from a UFS2 file > > > > system with the sleuthkit. > > > > > > > Unfortunatly, most sleuthkit > > > > utilities expect regular image files and won't operate > > > > on block devices: > > For the record, FreeBSD doesn't have block devices. They are all > character devices. Compare the output of "ls -l /dev | grep '^b'" with > that of ls -l /dev | grep '^c'. Ups, right. My mistake. > Might this be what is bugging sleuthkit? They try to get the file size of the char device... > > phenom# mdconfig -a -t vnode -o readonly -f /dev/ad4s1e > > mdconfig: ioctl(/dev/mdctl): Invalid argument > > The vnode type md can only use regular files. See md(4). Yep. > > > > but unfortunatly, the file system I'm trying to analyze > > > > is VERY large and I don't have enough disk space elsewhere > > > > to take an image. > > Well, fls and other sleuthkit programs support split images. Will it fit > if you divide it into several smaller files? Good idea: that's one possible solution. > > > I would strongly advice you *not* to experiment with the original > > > disk, because this *may* lead you to more problems. > > very good advice IMHO. Correct. I'm VERY careful with the original disk. > > > But that's not the issue here. The file system itself is over 470GB > > (it occuples the whole 500GB disk), and while I do have spare 500GB > > disks, the whole image won't fit into a filesystem: it will be slightly > > too big. > > Maybe it will fit if you play with the newfs parameters of the new disk? > Shrinking the reserved space, enlarging the block and fragment size and > reducing the number of inodes, that kind of thing. If the file won't fit (still copying), I'll hook up a couple of 500GB disks to the box, and will try to newfs a bigger file system across all of them via gconcat(8). I haven't tried it before, but I hope it will work. Thanks for all the help. -cpghost. -- Cordula's Web. http://www.cordula.ws/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20090414200741.GA81984>