I am searching for (possibly) meaningful strings. This is a shot-in-the-dark kinda of effort. Thanks! Sean ----- Original Message ----- From: "Stefan Hajnoczi" <stefanha@xxxxxxxxx> To: "Sean McLinden" <mclinden@xxxxxxxxxxxx> Cc: kvm@xxxxxxxxxxxxxxx Sent: Tuesday, April 5, 2016 6:08:13 AM GMT -05:00 US/Canada Eastern Subject: Re: Searching the swapfile of a kvm/qemu image On Mon, Apr 04, 2016 at 11:53:45PM -0400, Sean McLinden wrote: > I am wondering if there are any serious downsides to doing a string search of a running KVM/QEMU swap partition on the host? I understand that mounting the OS (Linux) file systems can be a problem, but what about the swap partition of a live guest? Keep in mind that the contents of the swap partition can change at any time. I don't know the details of the swap on-disk layout, but if you need to read from multiple non-contiguous sectors you have a race condition where you might read part old and part new contents. What are you trying to achieve? Stefan -- NOTICE of CONFIDENTIALITY and DISCLAIMER This transmission, including attachments, is confidential. It may also be privileged or otherwise protected by work product immunity or other legal rules. If you have received it by mistake, please let us know by e-mail to the sender, only, and delete it from your system; you may not copy this message or disclose its contents to anyone. Unless expressly noted, above, this communication does not reflect an intention by the sender to conduct a transaction or make any agreement by electronic means. Nothing contained in this transmission shall constitute a contract or electronic signature under the ESIGN, any version of the UETA, or any other statute governing electronic transactions. If this transmission contains advice, the advice is based on instructions in relation to, and is provided to the addressee in connection with, the matter mentioned above. Responsibility is not accepted for reliance upon it by any other person or for any other purpose. -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
