|  |  | 
  
    |  |  | 
 
  |   |  | 
  
    |  |  | 
  
    |  |  | 
  
    |   xen-users
Re: [Xen-users] File-based FS vs others 
| On 5/23/06, Stephen Yum <steveyum@xxxxxxxxxxxxxx> wrote: That's propably because of what I do for a living (Computer Forensics).  We work with filesystem images all the time, but in general we try to maintain the entire filesystem, even the unallocated pages, they may contain evidence from previously deleted files.  Using dd (or its equivalent) is the only to do that.
Greg, 
 Why don't you just mount it and copy the stuff over to a physical/logical volume? That's what I did. For example, for download the Debian 3.1 image file from jailtime, and do the following from your dom0:
 
 # mount -o loop debian.3-1.img /mnt # mkdir -p /osTemplates/debian31_base # cp -ax /mnt/* /osTemplates/debian31_base 
 Make a swap file, create a config file, and away you go!
 In this case, my method was overkill because the filesystem files from jail.org aren't evidence.  Thus your approach above should be fine.
 
 FYI: If the jail is using mkfs options to tune the filesystem when they tune their systems then the cp process you use will not maintain them.  Using dd like I proposed should.  I don't know if the jail is doing any mkfs tuning or not.
 
 Greg
 --
 Greg Freemyer
 The Norcross Group
 Forensics for the 21st Century
 _______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users | 
 |  | 
  
    |  |  |