From owner-freebsd-stable@FreeBSD.ORG Fri Feb 8 23:29:37 2008 Return-Path: Delivered-To: freebsd-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id A230B16A419 for ; Fri, 8 Feb 2008 23:29:37 +0000 (UTC) (envelope-from dan@dan.emsphone.com) Received: from dan.emsphone.com (dan.emsphone.com [199.67.51.101]) by mx1.freebsd.org (Postfix) with ESMTP id 5E94513C448 for ; Fri, 8 Feb 2008 23:29:37 +0000 (UTC) (envelope-from dan@dan.emsphone.com) Received: (from dan@localhost) by dan.emsphone.com (8.14.2/8.14.2) id m18NTPfx095860; Fri, 8 Feb 2008 17:29:25 -0600 (CST) (envelope-from dan) Date: Fri, 8 Feb 2008 17:29:24 -0600 From: Dan Nelson To: Joe Peterson Message-ID: <20080208232923.GD85696@dan.emsphone.com> References: <47ACD7D4.5050905@skyrush.com> <47ACDE82.1050100@skyrush.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <47ACDE82.1050100@skyrush.com> X-OS: FreeBSD 7.0-PRERELEASE User-Agent: Mutt/1.5.17 (2007-11-01) Cc: freebsd-fs@freebsd.org, Mark Day , freebsd-stable@freebsd.org Subject: Re: Analysis of disk file block with ZFS checksum error X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Feb 2008 23:29:37 -0000 In the last episode (Feb 08), Joe Peterson said: > Mark Day wrote: > > Based on the subset of data you posted, the bad data looks like > > ASCII text. The bad data from offset a0000 to a000f is: > > > > ${138AFE{@ > > @$$}1 > > > > The bad data from offset af6c1 to af6c8 is: > > > > 392A9}@ > > > > I don't recognize the content beyond that, but I'd guess that > > somehow the contents of some other file managed to overwrite that > > portion of the bad file. As for how that happened, I don't know. > > But if someone recognizes where the bad content came from, that > > might be a clue. > > Good eye! Yes, it indeed does appear to be ASCII. I *thought* > something in the repetition when I originally did an od -a looked > interesting. > > I dumped the whole bad section as a string, and here's (partly) what I get: > > @$${138B8B{@ > <(21470=Thu Jan 24 23:20:58 2008)> > [117:^80(^91^21470)] > @$$}138B8B}@ ... > @$${138C18{@ > <(21472=1201242069)>[-2:^80(^82^85)(^83^1B5)(^84=b)(^85=1)(^86=0)(^87=0) > (^88=0)(^89^2146C)(^8A=)(^8B=40)(^8C=2e)(^8D^84)(^8E=0)(^90^21472) > (^91^21460)] > @$$}138C18}@ > > and more of the same. Note the date string. There are several like > that. Anyone recognize this text format? It's a Mork database from the Mozilla project: http://developer.mozilla.org/en/docs/Mork_Structure#Rows -- Dan Nelson dnelson@allantgroup.com