untrunc icon indicating copy to clipboard operation
untrunc copied to clipboard

ZFS file system

Open roopa01 opened this issue 5 years ago • 1 comments

Hi,

 I want to locate data in ZFS file system.I read On disk information format http://www.giis.co.in/Zfs_ondiskformat.pdf

and http://www.osdevcon.org/2009/slides/zfs_internals_uli_graef.pdf to read the internal structure of ZFS file system. I reached on Uberblock and read block pointer.I read structure of block pointer and got offset DVA(vdev + offset).According to document this offset points to MOS(Meta object set).After moving i got like this block 00 00 00 92 A2 0A 11 02 03 00 00 00 01 20 00 01 00 12 04 07 00 30 00 00 48 05 00 0F 02 00 0F 13

Is this MOS?If it is MOS how can i read this .What is the structure of MOS.If it is not MOS.Please help me to trace data after uberblock.

Thanks roopa01

roopa01 avatar Sep 08 '20 08:09 roopa01

I know absolutely nothing about ZFS. My best bet would be to look up the docs (section 4.2), anche check in the code https://github.com/freebsd/freebsd/blob/e663135dd19ff935615de840ae6e52c17a9cdbdd/sys/cddl/boot/zfs/zfsimpl.h

with these keywords: DMU_OST_META objset_phys dnode_phys

Sorry, can't really help you.

Federico

On Tue, Sep 8, 2020 at 10:08 AM roopa01 [email protected] wrote:

Hi,

I want to locate data in ZFS file system.I read On disk information format http://www.giis.co.in/Zfs_ondiskformat.pdf

and http://www.osdevcon.org/2009/slides/zfs_internals_uli_graef.pdf to read the internal structure of ZFS file system. I reached on Uberblock and read block pointer.I read structure of block pointer and got offset DVA(vdev + offset).According to document this offset points to MOS(Meta object set).After moving i got like this block 00 00 00 92 A2 0A 11 02 03 00 00 00 01 20 00 01 00 12 04 07 00 30 00 00 48 05 00 0F 02 00 0F 13

Is this MOS?If it is MOS how can i read this .What is the structure of MOS.If it is not MOS.Please help me to trace data after uberblock.

Thanks roopa01

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/ponchio/untrunc/issues/193, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAUDV262EVZIOW7XF7IBSHLSEXRABANCNFSM4Q7URKRQ .

ponchio avatar Sep 08 '20 08:09 ponchio