Help to edit inode content

Help to edit inode content

[ranjith kannikara]

Hi,
I am a computer science engineering student. We have started a project
to make an application to recover deleted files from an ext3
filesystem. For that we have a doubt . Can we edit the inode content?
ie the recovery will be robust if we could edit the inode contents and
give the pointer address manually or through a code. The inode is
being created in the kernel mode and is it possible to edit those
contents if the code is allowed to have the kernel mode permissions..?

Regards
Ranju..

Re: Help to edit inode content

[Bryan Donlan]

On Tue, May 12, 2009 at 11:47 AM, ranjith kannikara
<ranjithkannikara@gmail.com> wrote:
> Hi,
> I am a computer science engineering student. We have started a project
> to make an application to recover deleted files from an ext3
> filesystem. For that we have a doubt . Can we edit the inode content?
> ie the recovery will be robust if we could edit the inode contents and
> give the pointer address manually or through a code. The inode is
> being created in the kernel mode and is it possible to edit those
> contents if the code is allowed to have the kernel mode permissions..?

You'd probably be best off doing this in userspace, with the
filesystem unmounted.
Generally speaking, don't attempt to alter the filesystem from
userspace while it is mounted.

Re: Help to edit inode content

[ranjith kannikara]

On Tue, May 12, 2009 at 9:26 PM, Bryan Donlan <bdonlan@gmail.com> wrote:
> On Tue, May 12, 2009 at 11:47 AM, ranjith kannikara
> <ranjithkannikara@gmail.com> wrote:
>> Hi,
>> I am a computer science engineering student. We have started a project
>> to make an application to recover deleted files from an ext3
>> filesystem. For that we have a doubt . Can we edit the inode content?
>> ie the recovery will be robust if we could edit the inode contents and
>> give the pointer address manually or through a code. The inode is
>> being created in the kernel mode and is it possible to edit those
>> contents if the code is allowed to have the kernel mode permissions..?
>
> You'd probably be best off doing this in userspace, with the
> filesystem unmounted.
Of course we are doing it from another filesystem. ie only after
unmounting the filesystem which is being worked on. in some case we
make image of the filesystem to ensure security of data.
> Generally speaking, don't attempt to alter the filesystem from
> userspace while it is mounted.
>
But we would like to know whether it is possible to edit the inode
because it will make the recovery easy and robust. ie he know the
details of the inode of the file which had been deleted is it possible
to edit the content of that inode with the pointers of the deleted
file.?
Regards
Ranju.



-- 
http://www.ranjithkannikara.blogspot.com/

Re: Help to edit inode content

[Manish Katiyar]

On Tue, May 12, 2009 at 9:32 PM, ranjith kannikara
<ranjithkannikara@gmail.com> wrote:
> On Tue, May 12, 2009 at 9:26 PM, Bryan Donlan <bdonlan@gmail.com> wrote:
>> On Tue, May 12, 2009 at 11:47 AM, ranjith kannikara
>> <ranjithkannikara@gmail.com> wrote:
>>> Hi,
>>> I am a computer science engineering student. We have started a project
>>> to make an application to recover deleted files from an ext3
>>> filesystem. For that we have a doubt . Can we edit the inode content?

Hi,

yes you can. See the debugfs tool which comes with e2fsprogs. It
allows you to open a filesystem and then change the attributes of an
inode. It also has libext2fs which you can use to write programs
through its exported APIs.

Hope that helps

- Manish

>>> ie the recovery will be robust if we could edit the inode contents and
>>> give the pointer address manually or through a code. The inode is
>>> being created in the kernel mode and is it possible to edit those
>>> contents if the code is allowed to have the kernel mode permissions..?
>>
>> You'd probably be best off doing this in userspace, with the
>> filesystem unmounted.
> Of course we are doing it from another filesystem. ie only after
> unmounting the filesystem which is being worked on. in some case we
> make image of the filesystem to ensure security of data.
>> Generally speaking, don't attempt to alter the filesystem from
>> userspace while it is mounted.
>>
> But we would like to know whether it is possible to edit the inode
> because it will make the recovery easy and robust. ie he know the
> details of the inode of the file which had been deleted is it possible
> to edit the content of that inode with the pointers of the deleted
> file.?
> Regards
> Ranju.
>
>
>
> --
> http://www.ranjithkannikara.blogspot.com/
> --
> To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>



-- 
Thanks -
Manish

Re: Help to edit inode content

[Andreas Dilger]

On May 12, 2009  21:32 +0530, ranjith kannikara wrote:
> On Tue, May 12, 2009 at 9:26 PM, Bryan Donlan <bdonlan@gmail.com> wrote:
> > On Tue, May 12, 2009 at 11:47 AM, ranjith kannikara
> > <ranjithkannikara@gmail.com> wrote:
> >> I am a computer science engineering student. We have started a project
> >> to make an application to recover deleted files from an ext3
> >> filesystem. For that we have a doubt . Can we edit the inode content?
> >> ie the recovery will be robust if we could edit the inode contents and
> >> give the pointer address manually or through a code. The inode is
> >> being created in the kernel mode and is it possible to edit those
> >> contents if the code is allowed to have the kernel mode permissions..?
>
> But we would like to know whether it is possible to edit the inode
> because it will make the recovery easy and robust. ie he know the
> details of the inode of the file which had been deleted is it possible
> to edit the content of that inode with the pointers of the deleted
> file.?

Are you asking whether it is possible to modify the on-disk structure
of the ext3 inode?  Generally that is NOT allowed because it will of
course break all existing filesystems if not done with extreme care.

Cheers, Andreas
--
Andreas Dilger
Sr. Staff Engineer, Lustre Group
Sun Microsystems of Canada, Inc.

Re: Help to edit inode content

[ranjith kannikara]

On Wed, May 13, 2009 at 1:33 AM, Andreas Dilger <adilger@sun.com> wrote:
> On May 12, 2009  21:32 +0530, ranjith kannikara wrote:
>> On Tue, May 12, 2009 at 9:26 PM, Bryan Donlan <bdonlan@gmail.com> wrote:
>> > On Tue, May 12, 2009 at 11:47 AM, ranjith kannikara
>> > <ranjithkannikara@gmail.com> wrote:
>> >> I am a computer science engineering student. We have started a project
>> >> to make an application to recover deleted files from an ext3
>> >> filesystem. For that we have a doubt . Can we edit the inode content?
>> >> ie the recovery will be robust if we could edit the inode contents and
>> >> give the pointer address manually or through a code. The inode is
>> >> being created in the kernel mode and is it possible to edit those
>> >> contents if the code is allowed to have the kernel mode permissions..?
>>
>> But we would like to know whether it is possible to edit the inode
>> because it will make the recovery easy and robust. ie he know the
>> details of the inode of the file which had been deleted is it possible
>> to edit the content of that inode with the pointers of the deleted
>> file.?
>
> Are you asking whether it is possible to modify the on-disk structure
> of the ext3 inode? Generally that is NOT allowed because it will of
> course break all existing filesystems if not done with extreme care.
>
> Cheers, Andreas
> --
> Andreas Dilger
> Sr. Staff Engineer, Lustre Group
> Sun Microsystems of Canada, Inc.
>
>
Hi,
Actually I was asking the same. whether it is possible to edit the
inode content of a disk or the image of a disk. Did you mean that it
is not possible at all. Is there any method to edit the inode content
and use the edited inode for a file, If we can ensure high care.
because such a method will be the most robust one in the recovery of
deleted file.

Regards
ranju.

-- 
http://www.ranjithkannikara.blogspot.com/

Re: Help to edit inode content

[Manish Katiyar]

On Wed, May 13, 2009 at 9:41 AM, ranjith kannikara
<ranjithkannikara@gmail.com> wrote:
> On Wed, May 13, 2009 at 1:33 AM, Andreas Dilger <adilger@sun.com> wrote:
>> On May 12, 2009  21:32 +0530, ranjith kannikara wrote:
>>> On Tue, May 12, 2009 at 9:26 PM, Bryan Donlan <bdonlan@gmail.com> wrote:
>>> > On Tue, May 12, 2009 at 11:47 AM, ranjith kannikara
>>> > <ranjithkannikara@gmail.com> wrote:
>>> >> I am a computer science engineering student. We have started a project
>>> >> to make an application to recover deleted files from an ext3
>>> >> filesystem. For that we have a doubt . Can we edit the inode content?
>>> >> ie the recovery will be robust if we could edit the inode contents and
>>> >> give the pointer address manually or through a code. The inode is
>>> >> being created in the kernel mode and is it possible to edit those
>>> >> contents if the code is allowed to have the kernel mode permissions..?
>>>
>>> But we would like to know whether it is possible to edit the inode
>>> because it will make the recovery easy and robust. ie he know the
>>> details of the inode of the file which had been deleted is it possible
>>> to edit the content of that inode with the pointers of the deleted
>>> file.?
>>
>> Are you asking whether it is possible to modify the on-disk structure
>> of the ext3 inode? Generally that is NOT allowed because it will of
>> course break all existing filesystems if not done with extreme care.
>>
>> Cheers, Andreas
>> --
>> Andreas Dilger
>> Sr. Staff Engineer, Lustre Group
>> Sun Microsystems of Canada, Inc.
>>
>>
> Hi,
> Actually I was asking the same. whether it is possible to edit the
> inode content of a disk or the image of a disk. Did you mean that it
> is not possible at all. Is there any method to edit the inode content
> and use the edited inode for a file, If we can ensure high care.
> because such a method will be the most robust one in the recovery of
> deleted file.

Sorry , but it is still not clear to me whether you are trying to
change the on-disk structure of the inode or just change the ondisk
*contents* of some deleted inode to recover it.  Can you give an
example of what you are trying to do ?

Thanks -
Manish



>
> Regards
> ranju.
>
> --
> http://www.ranjithkannikara.blogspot.com/
> --
> To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>



-- 
Thanks -
Manish

Re: Help to edit inode content

[ranjith kannikara]

On Wed, May 13, 2009 at 9:44 AM, Manish Katiyar <mkatiyar@gmail.com> wrote:
> On Wed, May 13, 2009 at 9:41 AM, ranjith kannikara
> <ranjithkannikara@gmail.com> wrote:
>> On Wed, May 13, 2009 at 1:33 AM, Andreas Dilger <adilger@sun.com> wrote:
>>> On May 12, 2009  21:32 +0530, ranjith kannikara wrote:
>>>> On Tue, May 12, 2009 at 9:26 PM, Bryan Donlan <bdonlan@gmail.com> wrote:
>>>> > On Tue, May 12, 2009 at 11:47 AM, ranjith kannikara
>>>> > <ranjithkannikara@gmail.com> wrote:
>>>> >> I am a computer science engineering student. We have started a project
>>>> >> to make an application to recover deleted files from an ext3
>>>> >> filesystem. For that we have a doubt . Can we edit the inode content?
>>>> >> ie the recovery will be robust if we could edit the inode contents and
>>>> >> give the pointer address manually or through a code. The inode is
>>>> >> being created in the kernel mode and is it possible to edit those
>>>> >> contents if the code is allowed to have the kernel mode permissions..?
>>>>
>>>> But we would like to know whether it is possible to edit the inode
>>>> because it will make the recovery easy and robust. ie he know the
>>>> details of the inode of the file which had been deleted is it possible
>>>> to edit the content of that inode with the pointers of the deleted
>>>> file.?
>>>
>>> Are you asking whether it is possible to modify the on-disk structure
>>> of the ext3 inode? Generally that is NOT allowed because it will of
>>> course break all existing filesystems if not done with extreme care.
>>>
>>> Cheers, Andreas
>>> --
>>> Andreas Dilger
>>> Sr. Staff Engineer, Lustre Group
>>> Sun Microsystems of Canada, Inc.
>>>
>>>
>> Hi,
>> Actually I was asking the same. whether it is possible to edit the
>> inode content of a disk or the image of a disk. Did you mean that it
>> is not possible at all. Is there any method to edit the inode content
>> and use the edited inode for a file, If we can ensure high care.
>> because such a method will be the most robust one in the recovery of
>> deleted file.
>
> Sorry , but it is still not clear to me whether you are trying to
> change the on-disk structure of the inode or just change the ondisk
> *contents* of some deleted inode to recover it.  Can you give an
> example of what you are trying to do ?
>
> Thanks -
> Manish
>
Ok, I will
I want to edit the contects of some deleted inode to recover the file. ie
I have a file 'foo' with inode 123. and the inode have the direct and
indirect data pointers in it.
Now i deleted the file and is trying to recover it.
I somehow could get what was the content,which is the pointers in the inode.
Now I would like to edit the inode 123 so that it will contain the
above pointers and will be the same deleted file itself.

I hope now its clear and you can help me.
Regards
Ranju.
>
>
>>
>> Regards
>> ranju.
>>
>> --
>> http://www.ranjithkannikara.blogspot.com/
>> --
>> To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>>
>
>
>
> --
> Thanks -
> Manish
>



-- 
http://www.ranjithkannikara.blogspot.com/

Re: Help to edit inode content

[Manish Katiyar]

On Wed, May 13, 2009 at 9:53 AM, ranjith kannikara
<ranjithkannikara@gmail.com> wrote:
> On Wed, May 13, 2009 at 9:44 AM, Manish Katiyar <mkatiyar@gmail.com> wrote:
>> On Wed, May 13, 2009 at 9:41 AM, ranjith kannikara
>> <ranjithkannikara@gmail.com> wrote:
>>> On Wed, May 13, 2009 at 1:33 AM, Andreas Dilger <adilger@sun.com> wrote:
>>>> On May 12, 2009  21:32 +0530, ranjith kannikara wrote:
>>>>> On Tue, May 12, 2009 at 9:26 PM, Bryan Donlan <bdonlan@gmail.com> wrote:
>>>>> > On Tue, May 12, 2009 at 11:47 AM, ranjith kannikara
>>>>> > <ranjithkannikara@gmail.com> wrote:
>>>>> >> I am a computer science engineering student. We have started a project
>>>>> >> to make an application to recover deleted files from an ext3
>>>>> >> filesystem. For that we have a doubt . Can we edit the inode content?
>>>>> >> ie the recovery will be robust if we could edit the inode contents and
>>>>> >> give the pointer address manually or through a code. The inode is
>>>>> >> being created in the kernel mode and is it possible to edit those
>>>>> >> contents if the code is allowed to have the kernel mode permissions..?
>>>>>
>>>>> But we would like to know whether it is possible to edit the inode
>>>>> because it will make the recovery easy and robust. ie he know the
>>>>> details of the inode of the file which had been deleted is it possible
>>>>> to edit the content of that inode with the pointers of the deleted
>>>>> file.?
>>>>
>>>> Are you asking whether it is possible to modify the on-disk structure
>>>> of the ext3 inode? Generally that is NOT allowed because it will of
>>>> course break all existing filesystems if not done with extreme care.
>>>>
>>>> Cheers, Andreas
>>>> --
>>>> Andreas Dilger
>>>> Sr. Staff Engineer, Lustre Group
>>>> Sun Microsystems of Canada, Inc.
>>>>
>>>>
>>> Hi,
>>> Actually I was asking the same. whether it is possible to edit the
>>> inode content of a disk or the image of a disk. Did you mean that it
>>> is not possible at all. Is there any method to edit the inode content
>>> and use the edited inode for a file, If we can ensure high care.
>>> because such a method will be the most robust one in the recovery of
>>> deleted file.
>>
>> Sorry , but it is still not clear to me whether you are trying to
>> change the on-disk structure of the inode or just change the ondisk
>> *contents* of some deleted inode to recover it.  Can you give an
>> example of what you are trying to do ?
>>
>> Thanks -
>> Manish
>>
> Ok, I will
> I want to edit the contects of some deleted inode to recover the file. ie
> I have a file 'foo' with inode 123. and the inode have the direct and
> indirect data pointers in it.
> Now i deleted the file and is trying to recover it.
> I somehow could get what was the content,which is the pointers in the inode.
> Now I would like to edit the inode 123 so that it will contain the
> above pointers and will be the same deleted file itself.

Ok... then it is not what Andreas is concerned about. You should be
able to change it using the debugfs tool. See the command
"modify_inode" in it.

Thanks -
Manish



>
> I hope now its clear and you can help me.
> Regards
> Ranju.
>>
>>
>>>
>>> Regards
>>> ranju.
>>>
>>> --
>>> http://www.ranjithkannikara.blogspot.com/
>>> --
>>> To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
>>> the body of a message to majordomo@vger.kernel.org
>>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>>>
>>
>>
>>
>> --
>> Thanks -
>> Manish
>>
>
>
>
> --
> http://www.ranjithkannikara.blogspot.com/
>



-- 
Thanks -
Manish