Re: [sleuthkit-users] XFS image file analysis
Brought to you by:
carrier
Menu
▾
▴
Re: [sleuthkit-users] XFS image file analysis
|
From: Sagar B. <sag...@gm...> - 2012-12-05 06:10:06
|
Hi Derrick/RB,
Nice. Thank you so much for taking time and replying in so details.
Really appreciate it.
And I think, I didn't explain it fully in the beginning. Apologize for that.
This is a RAID image, and I don't have fully understanding of it fully.
Well here is the output for the commands by Derrick:
$ mmls /home/forensic/forensic-images/xfs-1tb.img
DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors
Slot Start End Length Description
00: Meta 0000000000 0000000000 0000000001 Primary Table (#0)
01: ----- 0000000000 0000000062 0000000063 Unallocated
02: 00:00 0000000063 1953520064 1953520002 Linux RAID (0xFD)
$ dd if=/home/forensic/forensic-images/xfs-1tb.img skip=16065 count=1 |
hexdump -C
00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|................|
*
00000200
1+0 records in
1+0 records out
512 bytes (512 B) copied, 0.0157509 s, 32.5 kB/s
$ sudo mount -t xfs -o ro,loop,offset=$((16065*512))
/home/forensic/forensic-images/xfs-1tb.img /mnt/temp/
mount: wrong fs type, bad option, bad superblock on /dev/loop1,
missing codepage or helper program, or other error
In some cases useful info is found in syslog - try
dmesg | tail or so
Following RB's method, I get:
$ sudo /sbin/losetup -o $((16065*512)) /dev/loop0
/home/forensic/forensic-images/xfs-1tb.img
losetup: /dev/loop0: device is busy
$ sudo /sbin/losetup -o $((16065*512)) /dev/loop1
/home/forensic/forensic-images/xfs-1tb.img
$ sudo xfs_ncheck /dev/loop1
xfs_ncheck: /dev/loop1 is not a valid XFS filesystem (unexpected SB magic
number 0x00000000)
$ sudo mount /dev/loop1 /mnt/temp/
mount: you must specify the filesystem type
$ sudo mount -t xfs /dev/loop1 /mnt/temp/
mount: wrong fs type, bad option, bad superblock on /dev/loop1,
missing codepage or helper program, or other error
In some cases useful info is found in syslog - try
dmesg | tail or so
Thanks,
Sagar Belure
On Wed, Dec 5, 2012 at 10:44 AM, Derrick Karpo <dk...@gm...> wrote:
> Exactly! Without going too far off topic, here's a sample image with
> an XFS partition at byte offset 16065. You can use mmls to find the
> offset of the partition, crudely confirm that the partition is XFS
> using dd, then mount it with the appropriate offset. This should be
> enough to get you going.
>
>
>
> $ mmls /tmp/bleck.img
> DOS Partition Table
> Offset Sector: 0
> Units are in 512-byte sectors
>
> Slot Start End Length Description
> 00: Meta 0000000000 0000000000 0000000001 Primary Table (#0)
> 01: ----- 0000000000 0000000062 0000000063 Unallocated
> 02: 00:00 0000000063 0000016064 0000016002 Linux (0x83)
> 03: 00:01 0000016065 0000079999 0000063935 Linux (0x83)
>
>
>
> $ dd if=/tmp/bleck.img skip=16065 count=1 | hexdump -C
> 1+0 records in
> 1+0 records out
> 512 bytes (512 B) copied00000000 58 46 53 42 00 00 10 00 00 00 00 00
> 00 00 1f 37 |XFSB...........7|
> 00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> |................|
> 00000020 90 d9 91 d9 e7 e7 45 44 ba b1 f8 91 a3 2c e3 63
> |......ED.....,.c|
> 00000030 00 00 00 00 00 00 00 04 00 00 00 00 00 00 4b 80
> |..............K.|
> 00000040 00 00 00 00 00 00 4b 81 00 00 00 00 00 00 4b 82
> |......K.......K.|
> 00000050 00 00 00 01 00 00 1f 37 00 00 00 01 00 00 00 00
> |.......7........|
> 00000060 00 00 04 b0 b4 a4 02 00 01 00 00 10 00 00 00 00
> |................|
> 00000070 00 00 00 00 00 00 00 00 0c 09 08 04 0d 00 00 19
> |................|
> 00000080 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 3d
> |.......@.......=|
> 00000090 00 00 00 00 00 00 1a 7f 00 00 00 00 00 00 00 00
> |................|
> 000000a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> |................|
> 000000b0 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00
> |................|
> 000000c0 00 00 00 00 00 00 00 01 00 00 00 0a 00 00 00 0a
> |................|
> 000000d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> |................|
> *
> 00000200
>
>
>
> $ sudo mount -t xfs -o ro,loop,offset=$((16065*512)) /tmp/bleck.img /mnt
> $ ls /mnt
> this-is-a-test.txt
>
>
> RB's suggestion of using the loopback is also a good idea. You can
> setup a loopback device at the appropriate offset, then use the
> loopback device for further processing.
>
> $ sudo /sbin/losetup -o $((16065*512)) /dev/loop0 /tmp/bleck.img
> $ sudo xfs_ncheck /dev/loop0
> 19332 this-is-a-test.txt
> $ sudo mount /dev/loop0 /mnt
> $ ls /mnt
> this-is-a-test.txt
>
> Derrick
>
>
> On Tue, Dec 4, 2012 at 9:51 PM, RB <ao...@gm...> wrote:
> > On Tue, Dec 4, 2012 at 9:36 PM, Sagar Belure <sag...@gm...>
> wrote:
> >> Yes. But that would require <device> as a parameter not image file.
> >> I don't have hard disk but hard disk image.
> >
> > You can handle that either by using 'losetup' to set up a loopback
> > block device at a specific offset in your image file, or use the '-o
> > loop,offset=XYZ' option to 'mount', which does the same thing.
> > Mounting an image "-o loop,offset=XYZ" just runs losetup in the
> > background, and all losetup is doing in this case is creating a
> > convenience mapping - you tell it that a block device you want to
> > handle is at byte offset XYZ in the image and it will transparently
> > translate all accesses to start at that address.
> >
> >> I'm not really sure how do operate on XFS filesystem image file.
> >
> > See above, unless you imaged the XFS filesystem with "xfsdump".
>
|
