Analysis of disk file block with ZFS checksum error
Dan Nelson
dnelson at allantgroup.com
Fri Feb 8 23:47:58 UTC 2008
In the last episode (Feb 08), Joe Peterson said:
> Mark Day wrote:
> > Based on the subset of data you posted, the bad data looks like
> > ASCII text. The bad data from offset a0000 to a000f is:
> >
> > ${138AFE{@
> > @$$}1
> >
> > The bad data from offset af6c1 to af6c8 is:
> >
> > 392A9}@
> >
> > I don't recognize the content beyond that, but I'd guess that
> > somehow the contents of some other file managed to overwrite that
> > portion of the bad file. As for how that happened, I don't know.
> > But if someone recognizes where the bad content came from, that
> > might be a clue.
>
> Good eye! Yes, it indeed does appear to be ASCII. I *thought*
> something in the repetition when I originally did an od -a looked
> interesting.
>
> I dumped the whole bad section as a string, and here's (partly) what I get:
>
> @$${138B8B{@
> <(21470=Thu Jan 24 23:20:58 2008)>
> [117:^80(^91^21470)]
> @$$}138B8B}@
...
> @$${138C18{@
> <(21472=1201242069)>[-2:^80(^82^85)(^83^1B5)(^84=b)(^85=1)(^86=0)(^87=0)
> (^88=0)(^89^2146C)(^8A=)(^8B=40)(^8C=2e)(^8D^84)(^8E=0)(^90^21472)
> (^91^21460)]
> @$$}138C18}@
>
> and more of the same. Note the date string. There are several like
> that. Anyone recognize this text format?
It's a Mork database from the Mozilla project:
http://developer.mozilla.org/en/docs/Mork_Structure#Rows
--
Dan Nelson
dnelson at allantgroup.com
More information about the freebsd-fs
mailing list