linux-ext4 - Any way to dump ext4 filesystem without file data blocks? (for later analysis)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200430134409.i5cxmmnbryx5hbui@baerbar.localdomain>
Date:   Thu, 30 Apr 2020 15:44:09 +0200
From:   Filip Štědronský <r.lkml@...narg.cz>
To:     linux-ext4@...r.kernel.org
Cc:     Theodore Ts'o <tytso@....edu>
Subject: Any way to dump ext4 filesystem without file data blocks? (for later
 analysis)

Hello,

I have experienced several mysterious ext4 issues on remote machines
with poor internet connection (mobile broadband) that are not easily
physically accessible.

I would like to download the filesystem image from the remote machine
for local investigation but the partition is rather large (500GB in
one instance) and I cannot easily upload that much data over the
mobile connection.

Is there any way to extract only filesystem metadata (superblock,
inodes, directory data blocks, etc.) from the partition but not
file data blocks? Ideally so that I could then reconstruct an
identical filesystem image, only with file data blocks zeroed out.

It seems it should be straightforwad to write such a tool but before
I start doing so, I wanted to check whether somebody hasn't already
written one. (It seems this might be a common enough need when
debugging and developing filesystems.) Short googling around and
searching list archive did not reveal anything.

Thanks for any pointers.

Filip Stedronsky