New answers tagged

3

You can read about the hash tree index used for directories here. A linear array of directory entries isn't great for performance, so a new feature was added to ext3 to provide a faster (but peculiar) balanced tree keyed off a hash of the directory entry name.


1

Finally found the answer from somebody else on another site, just zeroed the inodes and rechecked the system, that was all! debugfs -w /dev/sda2 :clri <1415> :clri <1416> :clri <1417> :q fsck -y /dev/sda2 To anybody else with this issue, I found my bad inodes using find on the bad mount, then checked dmesg for errors on the bad inodes.


0

Note that latest git version (will be released as 2.2) of KDE Partition Manager can do those steps. It still needs more testing, but so far it seems to work.


2

The forensic tools the recovery company will use could include EnCase Forensic, which is probably the leading forensic data recovery utility. EnCase takes the drive image recovers the raw data, then makes pretty intelligent assumptions as to what blocks form what files. There are still limitations, so an element of this is likely to be manually processed. ...


0

A small correction to the otherwise very detailed answer: The first number is the number of free non-zero blocks. (I.e. it does not count non-zero file blocks). As such, it is never larger than the number of free blocks. If you run zerofree (without -n) on a filesystem, then run it again (optionally with -n for dry-run) you will see that the first number ...


1

ext2 may be fine if the total size is small, otherwise fsck will take ages. But for large things you should dedicate a block device (LV) anyhow, not rely on file in filesystem containers. It's easy to lose such containers to both inner and outer filesystem corruption. If you don't actually write the files, and they can be compressed, squashfs may be another ...


2

SELinux context is stored in file's extended attributes (xattr, man 5 attr). Tools for working with them are available in core/attr package. Attributes, including SELinux context, can be retrieved with getfattr. There is a twist though: by default getfattr lists only attributes from user. namespace; and selinux attribute we need is in security namespace. So ...



Top 50 recent answers are included