-   Linux - General (
-   -   File data from inode (

sudheendrasp 05-14-2011 02:55 PM

File data from inode
I have a memory dump (hand made) of ROOTFS and I have dug into it to get the inode structure. I could read inode numb, size, filename and etc., but could not decode the data or the pages. Can someone help me fetch data from the inodes etc., I have.

Thank You!!

unSpawn 05-15-2011 07:50 AM

If I'm correct this is a duplicate of your previous thread on the same subject, right? How exactly (complete command line) did you make the dump? How (or in what application) did you load the dump and with what tools did you start parsing out inode numbers etc ? If a file system was found, with what tools did you try carving out any objects ?

catkin 05-15-2011 07:57 AM

You say you can read the inode -- so presumably you can get the data from it. Do you mean you want to get the file's data?

What is ROOTFS? Are we in Android-hacking territory?

sudheendrasp 05-16-2011 01:39 AM

This is not a perfect duplicate of the thread you mentioned as you observed I did progress forward using trace32 and reading superblocks using kernel symbols and further moved to file and inode objects. Now I have the radix page tree but could not read the page data where file is stored.

I have the inode and page tree but how should I process or interpret this radix tree to reach to the page for reading the file data.
ROOTS is kind of RAMFS right and I am no where nearer to android in anyway.

catkin 05-16-2011 08:45 AM

IDK about ROOTFS; netsearching for it found lots of Android pages, that's all.

If the source code that is used to read ROOTFS is available and comprehensible it should answer your question.

sudheendrasp 05-16-2011 12:18 PM

To update more about this, I tried to decode the i_data using radix tree algorithm and could reach to the page but still cant see any data.

All times are GMT -5. The time now is 03:17 PM.