linux-ext4 - Used dd to copy an ext4 filesystem, but target contained an old (mounted!) filesystem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4E9C1704.5000304@tuxes.nl>
Date:	Mon, 17 Oct 2011 12:52:36 +0100
From:	Bas van Schaik <bas@...es.nl>
To:	linux-ext4@...r.kernel.org
Subject: Used dd to copy an ext4 filesystem, but target contained an old (mounted!)
 filesystem

Hi all,

Long story short: I dd'ed 1.5TB of data to an LVM volume 'newdata' that 
already contained a filesystem (which I wanted to get rid of). 
Unfortunately, the old filesystem turned out to be mounted during the 
dd. After noticing this, I quickly created LVM snapshots of the 
'newdata' volume before unmounting the old filesystem (hoping that it 
didn't write out it fs data structures to 'newdata' yet, as I didn't 
access it) and tried mounting the snapshot. Unfortunately, it showed the 
old directory listing.

The actual data is definitely sitting on the 'newdata' volume, but the 
filesystem datastructures simply don't know about it. The source of the 
data is definitely gone, I can't simply dd it again.

Is there any other location where ext4 stores a copy of its data 
structures? Or any other tips & tricks?

Many thanks,

   Bas
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html