lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Mon, 8 Mar 2021 16:40:49 -0500
From:   "Theodore Ts'o" <>
To:     George Goffe <>
Subject: Re: Scrubbing filenames from meta-data dump of ext4 filesystems

On Mon, Mar 08, 2021 at 12:01:46PM -0800, George Goffe wrote:
> Howdy,
> I'm helping to shoot a bug on a Fedora Core 35 system and have been
> requested to provide a meta-data dump of the problem filesystem. The
> filenames are restricted so I need to scrub this file  before sending
> it.
> Does ext4 have a facility whereby I can scrub the filenames from the dump?

Yes, please see the following excerpt from the e2image man page:

    This will only send the metadata information, without any data
    blocks.  However, the filenames in the directory blocks can still
    reveal information about the contents of the filesystem that the
    bug reporter may wish to keep confidential.  To address this
    concern, the -s option can be specified.  This will cause e2image
    to scramble directory entries and zero out any unused portions of
    the directory blocks before writing the image file.  However, the
    -s option will prevent analysis of problems related to hash-tree
    indexed directories.

The -s option can be used with the -r and -Q options to e2image, for
creating raw and qcow2 image dumps, respectively.  Because the
filenames have been scrambled, this will invalidate the hash-tree
indexes for the directory, so e2fsck will complain about this.  But
for some kinds of corruption, the -s option can provide data when the
customer would otherwise not be willing to provide a metadata-only
dump of the file system.

Hope this helps,

				- Ted

Powered by blists - more mailing lists