linux-ext4 - Re: Used dd to copy an ext4 filesystem, but target contained an old (mounted!) filesystem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20111018010639.GJ4528@quack.suse.cz>
Date:	Tue, 18 Oct 2011 03:06:39 +0200
From:	Jan Kara <jack@...e.cz>
To:	Bas van Schaik <bas@...es.nl>
Cc:	linux-ext4@...r.kernel.org
Subject: Re: Used dd to copy an ext4 filesystem, but target contained an
 old (mounted!) filesystem

  Hi,
On Mon 17-10-11 12:52:36, Bas van Schaik wrote:
> Long story short: I dd'ed 1.5TB of data to an LVM volume 'newdata'
> that already contained a filesystem (which I wanted to get rid of).
> Unfortunately, the old filesystem turned out to be mounted during
> the dd. After noticing this, I quickly created LVM snapshots of the
> 'newdata' volume before unmounting the old filesystem (hoping that
> it didn't write out it fs data structures to 'newdata' yet, as I
> didn't access it) and tried mounting the snapshot. Unfortunately, it
> showed the old directory listing.
  So let me check I understand what happened. You had some "sourcevol"
containing a filesystem and 1.5 TB of data. You did:
  dd if=sourcevol of=newdata
Now you noticed newdata was mounted so you created lvm snapshot of newdata.
Then umount newdata.

Now if you mount newdata you still see contents of "sourcevol" but you'd
like to see "newdata". Am I correct?

If that's the case, shouldn't you try to mount the snapshot volume instead
of simply "newdata"?

> The actual data is definitely sitting on the 'newdata' volume, but
> the filesystem datastructures simply don't know about it. The source
> of the data is definitely gone, I can't simply dd it again.
> 
> Is there any other location where ext4 stores a copy of its data
> structures?
  Not really. Only the superblock is duplicated.

> Or any other tips & tricks?

								Honza
-- 
Jan Kara <jack@...e.cz>
SUSE Labs, CR
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html