Block device to regular file?

[cpghost]

On Tue, Apr 14, 2009 at 09:36:22PM +0200, Roland Smith wrote:
> On Tue, Apr 14, 2009 at 07:48:16PM +0200, cpghost wrote:
> > On Tue, Apr 14, 2009 at 07:18:43PM +0200, Polytropon wrote:
> > > On Tue, 14 Apr 2009 18:17:24 +0200, cpghost <cpghost at cordula.ws> wrote:
> > > > I'm trying to recover some deleted files from a UFS2 file
> > > > system with the sleuthkit.
> > > 
> > > > Unfortunatly, most sleuthkit
> > > > utilities expect regular image files and won't operate
> > > > on block devices:
> 
> For the record, FreeBSD doesn't have block devices. They are all
> character devices. Compare the output of "ls -l /dev | grep '^b'" with
> that of ls -l /dev | grep '^c'. 

Ups, right. My mistake.

> Might this be what is bugging sleuthkit?

They try to get the file size of the char device...

> >   phenom# mdconfig -a -t vnode -o readonly -f /dev/ad4s1e
> >   mdconfig: ioctl(/dev/mdctl): Invalid argument
> 
> The vnode type md can only use regular files. See md(4).

Yep.

> > > > but unfortunatly, the file system I'm trying to analyze
> > > > is VERY large and I don't have enough disk space elsewhere
> > > > to take an image.
> 
> Well, fls and other sleuthkit programs support split images. Will it fit
> if you divide it into several smaller files? 

Good idea: that's one possible solution.

> > > I would strongly advice you *not* to experiment with the original
> > > disk, because this *may* lead you to more problems.
> 
> very good advice IMHO.

Correct. I'm VERY careful with the original disk.

> 
> > But that's not the issue here. The file system itself is over 470GB
> > (it occuples the whole 500GB disk), and while I do have spare 500GB
> > disks, the whole image won't fit into a filesystem: it will be slightly
> > too big.
> 
> Maybe it will fit if you play with the newfs parameters of the new disk?
> Shrinking the reserved space, enlarging the block and fragment size and
> reducing the number of inodes, that kind of thing.

If the file won't fit (still copying), I'll hook up a couple of
500GB disks to the box, and will try to newfs a bigger file system
across all of them via gconcat(8). I haven't tried it before, but
I hope it will work.

Thanks for all the help.

-cpghost.

-- 
Cordula's Web. http://www.cordula.ws/