Bug#802089: ext4magic: recover or examine on ext4 file system is impossible
Hi Roberto,
Thanks for your report. I tested ext4magic over Debian Unstable now
and the problem also occurs.
I applied your patch and uploaded a new package to unstable. When in
testing (five days), I will upload to Jessie-Backports.
To close this bug, I will wait a final solution.
Thanks a lot in advance.
Regards,
Eriberto
2015-10-17 10:45 GMT-03:00 Roberto Maar <robi6 at users.sf.net>:
> Package: ext4magic
> Version: 0.3.2-2
> Severity: normal
>
> Dear Maintainer,
>
> ext4magic has a misinterpretation of the physical block addresses and block lengths of ext4 inode.
> With each call by ext4magic be other random and too large values dertermined.
> Thus, a recover from ext4 file system is not possible.
> The error is permanent and 100% reproducible (also on i386)
> Often with the additional warning: "error-NR 22 can not found file"
>
>
> Example:
>
> # ext4magic -T -I2 -x /dev/sdb1 #debian 8.2 (amd64)
> ....
> Dump Inode 2 from journal transaction 0
> Inode: 2 Type: directory Mode: 0755 Flags: 0x80000
> Generation: 0 Version: 0x00000000:00000004
> User: 0 Group: 0 Size: 4096
> File ACL: 0 Directory ACL: 0
> Links: 5 Blockcount: 8
> Fragment: Address: 0 Number: 0 Size: 0
> ctime: 1444944845:3712000000 -- Thu Oct 15 23:34:05 2015
> atime: 1444944255:1968000000 -- Thu Oct 15 23:24:15 2015
> mtime: 1444944845:3712000000 -- Thu Oct 15 23:34:05 2015
> crtime: 1444943306:0000000000 -- Thu Oct 15 23:08:26 2015
> Size of extra inode fields: 28
> Level Entries Logical Physical Length Flags
> 0/ 0 1/ 1 0 - 25855 89219572695840 - 89219572721695 25856
> ......
> The block length 25855 and the start block 89219572695840 are random values
> and the false block data would also be used while trying a recover.
>
>
>
> The correct output should be: #OpenSuse 13.1 (x86-64)
> ......
> Dump Inode 2 from journal transaction 0
> Inode: 2 Type: directory Mode: 0755 Flags: 0x80000
> Generation: 0 Version: 0x00000000:00000004
> User: 0 Group: 0 Size: 4096
> File ACL: 0 Directory ACL: 0
> Links: 5 Blockcount: 8
> Fragment: Address: 0 Number: 0 Size: 0
> ctime: 1444944845:3712000000 -- Thu Oct 15 23:34:05 2015
> atime: 1444944255:1968000000 -- Thu Oct 15 23:24:15 2015
> mtime: 1444944845:3712000000 -- Thu Oct 15 23:34:05 2015
> crtime: 1444943306:0000000000 -- Thu Oct 15 23:08:26 2015
> Size of extra inode fields: 28
> Level Entries Logical Physical Length Flags
> 0/ 0 1/ 1 0 - 0 8865 - 8865 1
> 2 d 755 (2) 0 0 4096 15-Oct-2015 23:08 .
> 2 d 755 (2) 0 0 4096 15-Oct-2015 23:08 ..
> 11 d 700 (2) 0 0 16384 15-Oct-2015 23:08 lost+found
> 393217 d 755 (2) 0 0 12288 15-Oct-2015 23:04 etc
> < 131073> d 755 (2) 0 0 65536 15-Oct-2015 23:20 doc
> 524289 d 755 (2) 0 0 4096 15-Oct-2015 22:51 help
> .......
>
> See also Ticket #3 on ext4magic sf.net site.
>
>
> -- System Information:
> Debian Release: 8.2
> APT prefers stable-updates
> APT policy: (500, 'stable-updates'), (500, 'stable')
> Architecture: amd64 (x86_64)
>
> Kernel: Linux 3.16.0-4-amd64 (SMP w/2 CPU cores)
> Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
> Shell: /bin/sh linked to /bin/dash
> Init: systemd (via /run/systemd/system)
>
> Versions of packages ext4magic depends on:
> ii e2fslibs 1.42.12-1.1
> ii libblkid1 2.25.2-6
> ii libbz2-1.0 1.0.6-7+b3
> ii libc6 2.19-18+deb8u1
> ii libmagic1 1:5.22+15-2
> ii libuuid1 2.25.2-6
> ii zlib1g 1:1.2.8.dfsg-2+b1
>
> ext4magic recommends no packages.
>
> ext4magic suggests no packages.
>
> -- no debconf information
>
> _______________________________________________
> forensics-devel mailing list
> forensics-devel at lists.alioth.debian.org
> http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/forensics-devel
Reply to: