LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices


Reply
  Search this Thread
Old 05-14-2011, 03:55 PM   #1
sudheendrasp
LQ Newbie
 
Registered: Jul 2010
Posts: 13

Rep: Reputation: 0
File data from inode


Hi
I have a memory dump (hand made) of ROOTFS and I have dug into it to get the inode structure. I could read inode numb, size, filename and etc., but could not decode the data or the pages. Can someone help me fetch data from the inodes etc., I have.

Thank You!!
 
Old 05-15-2011, 08:50 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,394
Blog Entries: 55

Rep: Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565
If I'm correct this is a duplicate of your previous thread on the same subject, right? How exactly (complete command line) did you make the dump? How (or in what application) did you load the dump and with what tools did you start parsing out inode numbers etc ? If a file system was found, with what tools did you try carving out any objects ?
 
Old 05-15-2011, 08:57 AM   #3
catkin
LQ 5k Club
 
Registered: Dec 2008
Location: Tamil Nadu, India
Distribution: Debian
Posts: 8,577
Blog Entries: 31

Rep: Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195
You say you can read the inode -- so presumably you can get the data from it. Do you mean you want to get the file's data?

What is ROOTFS? Are we in Android-hacking territory?
 
Old 05-16-2011, 02:39 AM   #4
sudheendrasp
LQ Newbie
 
Registered: Jul 2010
Posts: 13

Original Poster
Rep: Reputation: 0
@unswan:
This is not a perfect duplicate of the thread you mentioned as you observed I did progress forward using trace32 and reading superblocks using kernel symbols and further moved to file and inode objects. Now I have the radix page tree but could not read the page data where file is stored.

@catkin:
I have the inode and page tree but how should I process or interpret this radix tree to reach to the page for reading the file data.
ROOTS is kind of RAMFS right and I am no where nearer to android in anyway.
 
Old 05-16-2011, 09:45 AM   #5
catkin
LQ 5k Club
 
Registered: Dec 2008
Location: Tamil Nadu, India
Distribution: Debian
Posts: 8,577
Blog Entries: 31

Rep: Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195Reputation: 1195
IDK about ROOTFS; netsearching for it found lots of Android pages, that's all.

If the source code that is used to read ROOTFS is available and comprehensible it should answer your question.
 
Old 05-16-2011, 01:18 PM   #6
sudheendrasp
LQ Newbie
 
Registered: Jul 2010
Posts: 13

Original Poster
Rep: Reputation: 0
To update more about this, I tried to decode the i_data using radix tree algorithm and could reach to the page but still cant see any data.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
inode data structure? surabhi suppu Programming 2 04-14-2011 03:07 PM
Corrupted root inode on ext3 RAID - data recovery LostTowel Linux - Software 2 08-24-2008 12:10 AM
Quickly retrieve a file from its file system / inode jef_te Linux - Newbie 1 04-17-2008 08:50 PM
Can you write a script to display file name, Inode, and size of any file? JaxsunApex Linux - Newbie 3 01-30-2007 09:39 AM
need to recover data in a deleted inode wilsonsamm Linux - General 6 08-30-2006 12:34 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - General

All times are GMT -5. The time now is 09:47 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration