Dumping Information Related to EXT (2/3/4)

man page is somewhat helpful.

this paper illustrates some insights about journaling.

examples of using debugfs.

wiki for ext4 layout.

a post that describes how to access journal.

Thanks to these resources.

Misconceptions

• when you use logdump, the starting blocks is with respect to the journal, not the whole disk.

Hence you need to do the following

dump_extents <8> 

where 8 is usually the inode number of the journal.

• when the man page mention that the command looks like
  • cat filespec

It actually means that you need to type in cat filespec in the debugfs shell. It also implies that the filespec is something like <inode>

• Note that <> here does not mean you need to include the value of inode, but the literal string <inode>, so you need to type < and > in the debugfs shell. (Really confusing design).

Tips

• Use -R flag to run a single command and exit.

• You can use arrow keys to navigate through the history of commands.

This post is very short, because I think with these tips, the related resources are enough for you to get started.

About moomoohorse

Hi I a Hao Ren. Please know me in mywebsite

Email : haor2@illinois.edu

Website : http://moomoohorse.com