Re: document ext3 requirements

Ingo Oeser
2009-01-04T21:49:32Z

On Sunday 04 January 2009, Robert Hancock wrote:
> I agree, there should be a way to force it to mount "really read only"
> so it doesn't try to replay the journal. That might require just
> ignoring the journal content, which may result in the FS appearing
> corrupt, but for recovery/forensics purposes that seems better than
> nothing..

For forensics you ALWAYS get a copy of the full disk first,
which you set read only with blockdev --setro /dev/$MYDISK.

You then restore from this copy.

Best Regard

Ingo Oeser, been there, done that