Re: FFS corruption

[David Holland <dholland-tech%netbsd.org@localhost>]

I wrote "that's an inode"; now in living colour:

On Mon, Nov 20, 2017 at 08:09:28AM +0000, Emmanuel Dreyfus wrote:
 > 00000000  80 81 01 00 00 00 00 00  00 00 00 00 00 00 00 00

di_mode = 0x8180 = 0100600 (mode 600 regular file)
di_nlink = 1
di_oldids = 0 (uninteresting)
di_size = 0

 > 00000010  5a 8d 0e 5a 60 8e 09 0f  5a 8d 0e 5a 60 8e 09 0f
 > 00000020  5a 8d 0e 5a 60 8e 09 0f  00 00 00 00 00 00 00 00

di_atime = di_mtime = di_ctime = 1510903130.252284512
  = Fri Nov 17 07:18:50.252284512 UTC 2017

 > 00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
 > *
 > 00000060  00 00 00 00 00 00 00 00  00 00 00 00 f4 4e a9 72

di_db[] = di_ib[] = all zero (consistent with size of 0)
di_flags = 0
di_blocks = 0
di_gen = 1923698420

 > 00000070  90 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00

di_uid = 400
di_gid = 0
di_modrev = 0

 > 00000080  80 81 01 00 00 00 00 00  00 00 00 00 00 00 00 00
 > 00000090  7f 8d 0e 5a 7e 77 dc 25  7f 8d 0e 5a 7e 77 dc 25
 > 000000a0  7f 8d 0e 5a 7e 77 dc 25  00 00 00 00 00 00 00 00
 > 000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
 > *
 > 000000e0  00 00 00 00 00 00 00 00  00 00 00 00 8b 73 ed 77
 > 000000f0  90 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00

Next inode: pretty much the same except the time is Fri Nov 17
07:19:27 UTC 2017, and the generation number is different (which is
expected...)

 > 00000100  80 81 01 00 00 00 00 00  00 00 00 00 00 00 00 00
 > 00000110  92 8d 0e 5a 54 43 af 15  92 8d 0e 5a 54 43 af 15
 > 00000120  92 8d 0e 5a 54 43 af 15  00 00 00 00 00 00 00 00
 > 00000130  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
 > *

and this one's a few seconds later.

Unfortunately ffs inodes don't contain their own identity, but if you
run out of other ideas you can probably search for a file with
generation number 1923698420, and then if the file with the next inode
number after it (likely, but not necessarily, in the same directory)
has generation number 2012050315 you've found where it's coming from.
Of course these might have gone away and been replaced in the meantime
depending...

-- 
David A. Holland
dholland%netbsd.org@localhost