Pradeep Kumar <praks411@xxxxxxxxx> wrote: >Hi, > >I'm writing a small utility to parse XFS fs image on windows. >I'm able to fetch the files in the first AG (0). >However when it comes to the files which are in different AG I'm facing >some problem in parsing extent bmap 128bits data of file inode (format >== >2). > >Here is the sample 128bits data >1. 00 00 00 00 00 00 00 00 00 00 00 04 99 80 00 01 (LSB) > >After unpacking the bits are per doc and source code >In the above case I'm getting following >Num Of blocks = 1 (correct) (0 to 20 bits) >absolute block number = 9420 (0x24CC) (wrong) (21 to 72) >file offset = 0 (72 to 126) > >I'm always getting wrong absolute block number . Actual data is in >block >7628 (0x1DCC). >No matter what I try I'm always getting the same result. I've even >verified >this >by using the code from xfs_bmbt_get_all function from xfs source which >too >gives me same result (9420). >Please someone help me with this. I'm stuck on this from 3 days. > >Thanks and Regards, >Pradeep Pradeep, It would be cool if your utility could be incorporated into sleuthkit. Sleuthkit has fat and NTFS parsers for sure already. I think ext2 and ext3. Adding a xfs parser would be a cool addition. http://www.sleuthkit.org/sleuthkit/docs/api-docs/index.html#users_guide Fyi: sleuthkit has been around for a long time, but it is still actively maintained and heavily used. It is in several linux distros, but is also available for windows. Greg -- Sent from my Android phone with K-9 Mail. Please excuse my brevity. _______________________________________________ xfs mailing list xfs@xxxxxxxxxxx http://oss.sgi.com/mailman/listinfo/xfs
