linux-ext4 - Re: Any way to dump ext4 filesystem without file data blocks? (for later analysis)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 30 Apr 2020 16:03:09 +0200
From:   Lukas Czerner <lczerner@...hat.com>
To:     Filip Štědronský <r.lkml@...narg.cz>
Cc:     linux-ext4@...r.kernel.org, Theodore Ts'o <tytso@....edu>
Subject: Re: Any way to dump ext4 filesystem without file data blocks? (for
 later analysis)

On Thu, Apr 30, 2020 at 03:44:09PM +0200, Filip Štědronský wrote:
> Hello,
> 
> I have experienced several mysterious ext4 issues on remote machines
> with poor internet connection (mobile broadband) that are not easily
> physically accessible.
> 
> I would like to download the filesystem image from the remote machine
> for local investigation but the partition is rather large (500GB in
> one instance) and I cannot easily upload that much data over the
> mobile connection.
> 
> Is there any way to extract only filesystem metadata (superblock,
> inodes, directory data blocks, etc.) from the partition but not
> file data blocks? Ideally so that I could then reconstruct an
> identical filesystem image, only with file data blocks zeroed out.
> 
> It seems it should be straightforwad to write such a tool but before
> I start doing so, I wanted to check whether somebody hasn't already
> written one. (It seems this might be a common enough need when
> debugging and developing filesystems.) Short googling around and
> searching list archive did not reveal anything.
> 
> Thanks for any pointers.
> 
> Filip Stedronsky

Hello Filip,

indeed there is a tool exactly for this purpose. It is called e2image
and it's part of the e2fsprogs. The manual page also have some useful
examples of how to use it.

Good luck.

-Lukas