Re: DM_snapshot_cow filesystem (dmsetup create snapshot)

[Douglas McClendon <dmc.lists@filteredperception.org>]

On 11/27/2011 04:31 PM, Frederick Grose wrote:
> On Sat, Oct 29, 2011 at 4:49 PM, Alasdair G Kergon <agk@redhat.com
> <mailto:agk@redhat.com>> wrote:
>
>     markmc did some code that shows how to read the format a few years
>     ago here:
>     http://people.gnome.org/~markmc/code/merge-dm-snapshot.c
>     <http://people.gnome.org/%7Emarkmc/code/merge-dm-snapshot.c>
>
>     Otherwise look at dm-snap-persistent.c in the kernel tree.
>
>     Alasdair
>
>
> Users can easily exhaust a LiveUSB snapshot overlay by writing
> too many changes to the OS filesystem, such as by performing
> a yum update.
>
> Would such an 'exhausted' overlay be amenable to some sort of
> data recovery or forensics?
>
> If so, how so; if not, why not?

Can you not mount the exhausted dm snapshot?  If you mean data recovery 
or forensics beyond that, please elaborate.

I know I've had issues 'read-only' mounting ext3(2?3?4?) filesystems 
before (on actually read-only block devices).  Maybe some flags that 
I've forgotten get past that, but worst case you can always fake a 
writable device with a 2nd overlay/snapshot going to a writable device, 
i.e. if you wanted to let fsck repair things.

-dmc