From owner-freebsd-questions@FreeBSD.ORG Mon Mar 4 12:21:56 2013 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.FreeBSD.org [8.8.178.115]) by hub.freebsd.org (Postfix) with ESMTP id EB319C0A for ; Mon, 4 Mar 2013 12:21:56 +0000 (UTC) (envelope-from jhs@berklix.com) Received: from flat.berklix.org (flat.berklix.org [83.236.223.115]) by mx1.freebsd.org (Postfix) with ESMTP id 6453615D2 for ; Mon, 4 Mar 2013 12:21:55 +0000 (UTC) Received: from mart.js.berklix.net (pD9FBF679.dip.t-dialin.net [217.251.246.121]) (authenticated bits=128) by flat.berklix.org (8.14.5/8.14.5) with ESMTP id r24CLS6k056487; Mon, 4 Mar 2013 13:21:29 +0100 (CET) (envelope-from jhs@berklix.com) Received: from fire.js.berklix.net (fire.js.berklix.net [192.168.91.41]) by mart.js.berklix.net (8.14.3/8.14.3) with ESMTP id r24CLYMF007651; Mon, 4 Mar 2013 13:21:35 +0100 (CET) (envelope-from jhs@berklix.com) Received: from fire.js.berklix.net (localhost [127.0.0.1]) by fire.js.berklix.net (8.14.4/8.14.4) with ESMTP id r24CLNwT011267; Mon, 4 Mar 2013 13:21:28 +0100 (CET) (envelope-from jhs@fire.js.berklix.net) Message-Id: <201303041221.r24CLNwT011267@fire.js.berklix.net> To: Polytropon Subject: Re: Grepping though a disk From: "Julian H. Stacey" Organization: http://berklix.com BSD Unix Linux Consultancy, Munich Germany User-agent: EXMH on FreeBSD http://berklix.com/free/ X-URL: http://www.berklix.com In-reply-to: Your message "Mon, 04 Mar 2013 01:36:08 +0100." <20130304013608.7981e8a9.freebsd@edvax.de> Date: Mon, 04 Mar 2013 13:21:23 +0100 Sender: jhs@berklix.com Cc: FreeBSD Questions X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Mar 2013 12:21:57 -0000 Hi Polytropon & cc questions@ > Any suggestion is welcome! Ideas: A themed list: freebsd-fs@freebsd.org There's a bunch of fs tools in /usr/ports/sysutils/ My http://www.berklix.com/~jhs/src/bsd/jhs/bin/public/slice/ slices large images such as tapes & disks (also the slice names would give numbers convertable to offsets probaably useful to eg ..a) man fsdb A bit of custom C should run a lot faster than shells & greps, eg when I was looking for nasty files from a bad scsi controller, I wrote http://www.berklix.com/~jhs/src/bsd/jhs/bin/public/8f/ One could run eg slice asynchronously & suspend ^Z when you run out of space, & periodicaly run some custom C (like 8f.c) or some find grep -v rm loop to discard most slices as of no interest. Then resume slicing. OK, thats doing writes too, so slower than just read & a later dd with seek=whatever, depends how conservative one's feeling, about doing reruns with other search criteria. You mentioned risk of text string chopped across a slice/block boundary. Certainly a risk. Presumably solution is to search twice. 2nd time after a dd with a half block/ slice size offset, then slice/search again. If you runout of space to do that, you might write a temporary disklabel/bsdlabel with an extra partition with a half block offset .. dodgy stuff that, do it while you'r wide awake :-) Always a pain these scenarios, loosing hours of human & CPU time, I hope data's worth it, good luck. Cheers, Julian -- Julian Stacey, BSD Unix Linux C Sys Eng Consultant, Munich http://berklix.com Reply below not above, like a play script. Indent old text with "> ". Send plain text. No quoted-printable, HTML, base64, multipart/alternative.