linux-ext4 - [RFC][PATCH 0/1] ext4: Undelete Feature for Ext4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1395155370.15587.9.camel@zerobox.home>
Date:	Tue, 18 Mar 2014 16:09:30 +0100
From:	Lubos Uhliarik <uhliarik@...nam.cz>
To:	linux-ext4@...r.kernel.org
Cc:	lczerner@...hat.com, vojnar@....vutbr.cz
Subject: [RFC][PATCH 0/1] ext4: Undelete Feature for Ext4

Hi all,

I'm sending you a patch (see the 1/1 patch) which should make
undelete process for deleted files on ext4 easier. I do this 
patch as a part of my Barchelor's thesis with support of Red Hat
company. 

The main changes in patch are following:

a) commented out zeroing ex->ee_len, ee->start_hi and ee->start_lo,
because these entries are essential for undelete process

b) only in inode structure, storing original value of eh->depth and
eh->entries. These values are stored to unused entry eh_generation in
struct ext4_extent_header after all extents have been definitely
removed. eh->entries is 16 bits value and is stored in first half of 32
bits of eh->generation. eh->depth is also 16 bits value and is stored in
second half of eh->generation. For storing these valued, I wrote macros
to ext4_extents.h. It's should NOT cause problems to store values in 
eh->generation, because eh->generation is used only, when file is NOT
deleted. After delete process, eh->generation can have any value.

c) if deletion process removes extents from block, which is not inode
(eh->depth > 0), then I'm storing only eh->entries original value to
eh->generation, because eh->depth will stay untouched. 

d) if delete process removes all extent_idx structures from block, which
is not in inode (eh->depth > 0), then I'm storing also only eh->entries
original value. But in this case, I need to store original eh->entries
value for each level separately, because delete process is changing
eh->entries value during walking through extent tree. This problem is
solved by allocating array, where I will store original values

This patch shouldn't break ext4, I tested it with xfs_tests and tests 
were successfull.

I also successfully created undelete application, based on e2fslibs,
which demonstrates undelete process. (link:
https://github.com/uhliarik/ext4-undelete )

Thanks! 
Lubos Uhliarik

--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html