FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Redhat > EXT3 Users

 
 
LinkBack Thread Tools
 
Old 06-14-2011, 08:34 PM
Andreas Dilger
 
Default extcarve - ext2,ext3,ext4 file carving tool

On 2011-06-14, at 12:05 PM, Lakshmipathi.G wrote:
>> Block size: 4096
>
> Yes,your block size same as my test machine -thats fine (4KB should work fine).I can recommend you to use option "-i" but the option "-g" should recover files upto 48KB(but we are getting only 4KB) . So using option "-i" won't make any difference here.
>
> Files with 4KB size are possible only when extcarve finds header and footer on a single block.Other this, I'm running out of thoughts. I'll try with different data set (test in different environments) and see whether I can reproduce this issue.

Since ext3/4 work hard to allocate file blocks contiguously, it makes sense to
assume that after the header blocks the file blocks will be present. While
this is less likely to be true as the file size increases, for ext4 it is
usually true for files smaller than a few MB, which is many of them.

Cheers, Andreas






_______________________________________________
Ext3-users mailing list
Ext3-users@redhat.com
https://www.redhat.com/mailman/listinfo/ext3-users
 
Old 06-15-2011, 04:20 AM
"Lakshmipathi.G"
 
Default extcarve - ext2,ext3,ext4 file carving tool

On Wed, Jun 15, 2011 at 2:04 AM, Andreas Dilger <adilger@dilger.ca> wrote:




Since ext3/4 work hard to allocate file blocks contiguously, it makes sense to

assume that after the header blocks the file blocks will be present. *While

this is less likely to be true as the file size increases, for ext4 it is

usually true for files smaller than a few MB, which is many of them.

Thanks for the clarification. On ext4,I believe an extent can address upto 128MB. *So I assume, for a file of size 50MB ,there is possibility this will be stored contiguously. Is that correct assumption? and *If we *mounted ext3 as ext4, will the inode become extent based rather than the old direct/indirect block accessing method?



*


Cheers, Andreas









--
----
Cheers,
Lakshmipathi.G
FOSS Programmer.
www.giis.co.in

_______________________________________________
Ext3-users mailing list
Ext3-users@redhat.com
https://www.redhat.com/mailman/listinfo/ext3-users
 
Old 06-15-2011, 01:19 PM
Jidong Xiao
 
Default extcarve - ext2,ext3,ext4 file carving tool

On Wed, Jun 15, 2011 at 12:20 AM, Lakshmipathi.G
<lakshmipathi.g@gmail.com> wrote:
>
> On Wed, Jun 15, 2011 at 2:04 AM, Andreas Dilger <adilger@dilger.ca> wrote:
>>
>> Since ext3/4 work hard to allocate file blocks contiguously, it makes
>> sense to
>> assume that after the header blocks the file blocks will be present.
>> *While
>> this is less likely to be true as the file size increases, for ext4 it is
>> usually true for files smaller than a few MB, which is many of them.
>
> Thanks for the clarification. On ext4,I believe an extent can address upto
> 128MB. *So I assume, for a file of size 50MB ,there is possibility this will
> be stored contiguously. Is that correct assumption? and *If we *mounted ext3
> as ext4, will the inode become extent based rather than the old
> direct/indirect block accessing method?
>

My file system is ext3.

In addition, my partition size is very large, it is 400GB. Is that a problem?

I tried extcarve at two machines, both got the same results, i.e.,
only generated some 4KB non-sense files there.

Jidong

_______________________________________________
Ext3-users mailing list
Ext3-users@redhat.com
https://www.redhat.com/mailman/listinfo/ext3-users
 
Old 06-15-2011, 01:56 PM
"Lakshmipathi.G"
 
Default extcarve - ext2,ext3,ext4 file carving tool

On Wed, Jun 15, 2011 at 6:49 PM, Jidong Xiao <jidong.xiao@gmail.com> wrote:


My file system is ext3.



In addition, my partition size is very large, it is 400GB. Is that a problem?



I tried extcarve at two machines, both got the same results, i.e.,

only generated some 4KB non-sense files there.


*ext3 shouldn't be a problem. Give a try with "-i" option,* for the third input provide 256 as input. So that , It'll try upto 1MB files.


----
Please enter increased block limitdefault is 12) :256
----
Does that produce files greater than 4KB size ?


*


Jidong



--
----
Cheers,
Lakshmipathi.G
FOSS Programmer.
www.giis.co.in

_______________________________________________
Ext3-users mailing list
Ext3-users@redhat.com
https://www.redhat.com/mailman/listinfo/ext3-users
 
Old 06-15-2011, 03:42 PM
Jidong Xiao
 
Default extcarve - ext2,ext3,ext4 file carving tool

On Wed, Jun 15, 2011 at 9:56 AM, Lakshmipathi.G
<lakshmipathi.g@gmail.com> wrote:
>
>
> On Wed, Jun 15, 2011 at 6:49 PM, Jidong Xiao <jidong.xiao@gmail.com> wrote:
>>
>> My file system is ext3.
>>
>> In addition, my partition size is very large, it is 400GB. Is that a
>> problem?
>>
>> I tried extcarve at two machines, both got the same results, i.e.,
>> only generated some 4KB non-sense files there.
>>
>
> ext3 shouldn't be a problem. Give a try with "-i" option,* for the third
> input provide 256 as input. So that , It'll try upto 1MB files.
> ----
> Please enter increased block limitdefault is 12) :256
> ----
> Does that produce files greater than 4KB size ?
>
>
Yes by using -i and 256 as the third input, I can generate a few files
whose size is large than 4KB.

Here are the results: Most of the files are still 4KB and not
meaningful, some files whose size are 8KB, but still not meaningful,
i.e., only some unknown and strange contents in those files, only
those pdf files whose size are larger than 8KB are real files, they
are useful files.

Since my partition size is 400GB, I should have far more files than
here, but at two of my machines, extcarve stalled at some step, it
seems the process is still there but it stops generating more files.

jxiao@th107c-6:~> ls -l /mnt/usbstick/RECARVED_FILES/
total 384
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarve1RITdT.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarve1s8oaZ.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarve2lIpqA.cpp
-rwxrwxrwx 1 root root 28672 Jun 15 11:13 extcarve2vm7gW.pdf
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarve3JXkZD.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarve7FI0YM.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarve7kADgL.cpp
-rwxrwxrwx 1 root root 8192 Jun 15 11:13 extcarve8wouIy.pdf
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarvebqkCDK.cpp
-rwxrwxrwx 1 root root 8192 Jun 15 11:13 extcarveCbKucU.pdf
-rwxrwxrwx 1 root root 4096 Jun 15 11:07 extcarveCGxSgK.png
-rwxrwxrwx 1 root root 8192 Jun 15 11:13 extcarvecmUimP.pdf
-rwxrwxrwx 1 root root 4096 Jun 15 11:08 extcarved8HC0z.png
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarveD9ZSjI.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarveDO7CIl.cpp
-rwxrwxrwx 1 root root 36864 Jun 15 11:13 extcarvedqoMd4.pdf
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarvedWuCvQ.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:08 extcarveeCrRf1.png
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarveEfGMQZ.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarveGdJ8hw.cpp
-rwxrwxrwx 1 root root 8192 Jun 15 11:13 extcarvegf35Oa.pdf
-rwxrwxrwx 1 root root 24576 Jun 15 11:13 extcarvegXLHGf.pdf
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarveGZenG1.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarvehCFJFW.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarveiYO3Jp.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarveJkY8r1.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarveKyRrks.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:08 extcarvemPFqvs.png
-rwxrwxrwx 1 root root 32768 Jun 15 11:13 extcarvenAtFWu.pdf
-rwxrwxrwx 1 root root 8192 Jun 15 11:13 extcarveNiJHTt.pdf
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarveoKb9bp.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarveotikLR.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarveP194o9.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarvep9q2Oe.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarveqiQFRN.cpp
-rwxrwxrwx 1 root root 8192 Jun 15 11:13 extcarveqmfEed.pdf
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarveRF2d55.cpp
-rwxrwxrwx 1 root root 28672 Jun 15 11:13 extcarvesKXZwr.pdf
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarvesuUtai.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarveTDXWSm.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarveTQV47h.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarveuUmoN6.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarveVLW6aB.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarvew73gEx.cpp
-rwxrwxrwx 1 root root 12288 Jun 15 11:13 extcarvew9bYbn.jpg
-rwxrwxrwx 1 root root 8192 Jun 15 11:08 extcarvewEpAGI.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarveweQmFD.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarvexamR4b.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarveY4OWK3.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarvey5zhr8.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:08 extcarveYiwhLT.cpp
-rwxrwxrwx 1 root root 8192 Jun 15 11:13 extcarvezC2MHI.jpg
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarvezGrAFk.cpp
-rwxrwxrwx 1 root root 4096 Jun 15 11:13 extcarveZppUaG.cpp

-Jidong

_______________________________________________
Ext3-users mailing list
Ext3-users@redhat.com
https://www.redhat.com/mailman/listinfo/ext3-users
 

Thread Tools




All times are GMT. The time now is 04:01 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org