linux-ext4 - Re: Formatted/repartitioned wrong disk, arrgh!

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 6 Nov 2009 11:01:52 -0500
From:	Theodore Tso <tytso@....edu>
To:	Eric Sandeen <sandeen@...hat.com>
Cc:	Alexey Salmin <alexey.salmin@...il.com>,
	Jesper Jensen <linux-ext4_mailinglist@...ctor.dk>,
	linux-ext4@...r.kernel.org
Subject: Re: Formatted/repartitioned wrong disk, arrgh!

On Fri, Nov 06, 2009 at 08:39:33AM -0600, Eric Sandeen wrote:
>
> Well, if you repartitioned / moved the partition, then the new mkfs  
> likely wouldn't have perfectly overwritten the old metadata structures,  
> so if you can re-partition again and put the starting sector -back- at  
> the original location, an e2fsck might have a fighting chance to find  
> -something- ...

I thought what had been done was that a physical disk had a new ESX
layout slapped on top of it, and then a new partition label was
created, and *then* mkfs.ext4 was run --- so that the new filesystem
pretty much overlaid the original filesystem.  In that case, there
really isn't much that can be done.  If the repartitioning really did
move the start of the filesystem sufficiently to avoid smashing all of
the metadata fields, then I agree, there might be a chance....

One idea which Andi Kleen and I tossed around at Linux Kongress was to
add a 4 byte per-inode CRC that also mixed in the inode number (to
detect inode table blocks getting written to the wrong location on
disk) as well as a per-filesystem ID.  This would allow us to detect
inodes from pervious filesystems formats, which would also allow us to
avoid needing to zero out the inode table, and it might allow for
people to have a slightly better chance of recovering after a mke2fs
(as well as making mke2fs faster without needing to zero the inode
table, either in mke2fs or via a background kernel thread once the
file system is mounted).

					- Ted
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html