[SOLVED] File data from inode

sudheendrasp · 05-14-2011, 03:55 PM

Hi
I have a memory dump (hand made) of ROOTFS and I have dug into it to get the inode structure. I could read inode numb, size, filename and etc., but could not decode the data or the pages. Can someone help me fetch data from the inodes etc., I have.

Thank You!!

unSpawn · 05-15-2011, 08:50 AM

If I'm correct this is a duplicate of your previous thread on the same subject, right? How exactly (complete command line) did you make the dump? How (or in what application) did you load the dump and with what tools did you start parsing out inode numbers etc ? If a file system was found, with what tools did you try carving out any objects ?

catkin · 05-15-2011, 08:57 AM

You say you can read the inode -- so presumably you can get the data from it. Do you mean you want to get the file's data?

What is ROOTFS? Are we in Android-hacking territory?

sudheendrasp · 05-16-2011, 02:39 AM

@unswan:
This is not a perfect duplicate of the thread you mentioned as you observed I did progress forward using trace32 and reading superblocks using kernel symbols and further moved to file and inode objects. Now I have the radix page tree but could not read the page data where file is stored.

@catkin:
I have the inode and page tree but how should I process or interpret this radix tree to reach to the page for reading the file data.
ROOTS is kind of RAMFS right and I am no where nearer to android in anyway.

catkin · 05-16-2011, 09:45 AM

IDK about ROOTFS; netsearching for it found lots of Android pages, that's all.

If the source code that is used to read ROOTFS is available and comprehensible it should answer your question.

sudheendrasp · 05-16-2011, 01:18 PM

To update more about this, I tried to decode the i_data using radix tree algorithm and could reach to the page but still cant see any data.