From owner-freebsd-questions@FreeBSD.ORG Tue Apr 14 20:07:46 2009 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 7DF98106566B for ; Tue, 14 Apr 2009 20:07:46 +0000 (UTC) (envelope-from cpghost@cordula.ws) Received: from fw.farid-hajji.net (fw.farid-hajji.net [213.146.115.42]) by mx1.freebsd.org (Postfix) with ESMTP id D7D4C8FC14 for ; Tue, 14 Apr 2009 20:07:45 +0000 (UTC) (envelope-from cpghost@cordula.ws) Received: from phenom.cordula.ws (phenom [192.168.254.60]) by fw.farid-hajji.net (Postfix) with ESMTP id CC490339BE; Tue, 14 Apr 2009 22:07:42 +0200 (CEST) Date: Tue, 14 Apr 2009 22:07:42 +0200 From: cpghost To: Roland Smith Message-ID: <20090414200741.GA81984@phenom.cordula.ws> References: <20090414161724.GA3721@phenom.cordula.ws> <20090414191843.c32e7f93.freebsd@edvax.de> <20090414174816.GA80513@phenom.cordula.ws> <20090414193622.GA33883@slackbox.xs4all.nl> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20090414193622.GA33883@slackbox.xs4all.nl> User-Agent: Mutt/1.5.19 (2009-01-05) Cc: freebsd-questions@freebsd.org Subject: Re: Block device to regular file? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Apr 2009 20:07:46 -0000 On Tue, Apr 14, 2009 at 09:36:22PM +0200, Roland Smith wrote: > On Tue, Apr 14, 2009 at 07:48:16PM +0200, cpghost wrote: > > On Tue, Apr 14, 2009 at 07:18:43PM +0200, Polytropon wrote: > > > On Tue, 14 Apr 2009 18:17:24 +0200, cpghost wrote: > > > > I'm trying to recover some deleted files from a UFS2 file > > > > system with the sleuthkit. > > > > > > > Unfortunatly, most sleuthkit > > > > utilities expect regular image files and won't operate > > > > on block devices: > > For the record, FreeBSD doesn't have block devices. They are all > character devices. Compare the output of "ls -l /dev | grep '^b'" with > that of ls -l /dev | grep '^c'. Ups, right. My mistake. > Might this be what is bugging sleuthkit? They try to get the file size of the char device... > > phenom# mdconfig -a -t vnode -o readonly -f /dev/ad4s1e > > mdconfig: ioctl(/dev/mdctl): Invalid argument > > The vnode type md can only use regular files. See md(4). Yep. > > > > but unfortunatly, the file system I'm trying to analyze > > > > is VERY large and I don't have enough disk space elsewhere > > > > to take an image. > > Well, fls and other sleuthkit programs support split images. Will it fit > if you divide it into several smaller files? Good idea: that's one possible solution. > > > I would strongly advice you *not* to experiment with the original > > > disk, because this *may* lead you to more problems. > > very good advice IMHO. Correct. I'm VERY careful with the original disk. > > > But that's not the issue here. The file system itself is over 470GB > > (it occuples the whole 500GB disk), and while I do have spare 500GB > > disks, the whole image won't fit into a filesystem: it will be slightly > > too big. > > Maybe it will fit if you play with the newfs parameters of the new disk? > Shrinking the reserved space, enlarging the block and fragment size and > reducing the number of inodes, that kind of thing. If the file won't fit (still copying), I'll hook up a couple of 500GB disks to the box, and will try to newfs a bigger file system across all of them via gconcat(8). I haven't tried it before, but I hope it will work. Thanks for all the help. -cpghost. -- Cordula's Web. http://www.cordula.ws/