[debian-knoppix] Improved cloop driver
Hi Everyone,
The cloop driver is the core behind knoppix. The problem with the existing
cloop is that it saves the index for the compressed blocks at the start of
the file, then followed by the compressed chunks. This requires the
compressor to store the compressed file in virtual memory until the final
size of the index is known so it can be saved in the end. This is the warning
in the man page:
create_compressed_fs(1) Make sure you have enough swap to hold the
entire compressed image in virtual memory!
I have modified the cloop driver to produce a new loop driver that creates a
slightly different file format. There are basically 2 improvements:
1) the index is placed at the end, so the compressor just writes compressed
blocks until it gets to the end, and then dump the index.
2) The sizes of the compressed blocks is interleaved between the blocks. This
allows the index to be reconstructed in the event that the index is missing
(i.e. the file is truncated for example). This makes the compressed format
much more robust.
The reason for these changes is because this compressed format is used in a
digital forensic package called pyflag (http://pyflag.sourceforge.net). In
this context, compressed images can be taken of entire hard disks
(multi-gigabytes) and then the modified cloop driver can be used to mount
them in ro mode. The new compressed format is called "sgzip", but it may be
best if the cloop format was changed in future to incorporate the changes.
A working model is available here:
http://cvs.sourceforge.net/viewcvs.py/pyflag/pyflag/iosubsys/sgzip/
Is this something that might be useful for knoppix?
Michael.
_______________________________________________
debian-knoppix mailing list
debian-knoppix@linuxtag.org
http://mailman.linuxtag.org/mailman/listinfo/debian-knoppix
Reply to: