zfs-discuss@opensolaris.org
[Top] [All Lists]

Re: [zfs-discuss] ZFS forensics/revert/restore shellscript and how-to.

Subject: Re: [zfs-discuss] ZFS forensics/revert/restore shellscript and how-to.
From: fred pam
Date: Mon, 19 Apr 2010 00:55:26 PDT
Hi Max,

Thanks, that's what I was looking for. 

So, after reading it I come to the conclusion that it's actually the fact I've 
lost my MOS that makes it 'impossible' to retrieve the data.

My understanding of it all (growing yet still meager ;-): 
Uberblocks do not point to different MOS-es but refer to a transaction history 
within the MOS; within an uberblock it is in fact not the blockpointer (as it 
only points to the MOS) but the TGX that's determining what the system 'sees' 
as data.
The fact that I may or may not have older uberblocks is then made irrelevant, 
right?  

This seems, from a forensics perspective, quite a quick and powerful way of 
destroying data (especially when also encrypted). Mind you, I do not 
necessarily think this is a bad thing, I just like to be sure I understand the 
consequences...

Grtz, Fred
-- 
This message posted from opensolaris.org
_______________________________________________
zfs-discuss mailing list
zfs-discuss@xxxxxxxxxxxxxxx
http://mail.opensolaris.org/mailman/listinfo/zfs-discuss

<Prev in Thread] Current Thread [Next in Thread>