UBIFS recovery/forensics tools

[Andrew Tierney]

Richard,

Yes - let me just see how big it is compressed and get it uploaded
somewhere appropriate.


Andrew

On 27 September 2015 at 09:47, Richard Weinberger <richard at nod.at> wrote:
> Am 27.09.2015 um 10:37 schrieb Andrew Tierney:
>> I suspect a fsck utility will work quite well for a number of these.
>>
>> I guess the real issue is that as soon as any piece of data deviates
>> from the norm, current tools fall over rather than attempting to
>> recover. ubi_reader has verbose output that allows some degree of
>> tweaking, but it can still be awkward.
>>
>> The current issue I am working on is that I have one image with two
>> volumes contained within. The first volume can be recovered fine, but
>> the second starts walking the index, reads a common header, an ino,
>> and then stops. I can observe significant data in the remainder of the
>> file. There is no other location on the system for a root directory,
>> so I suspect that the index is being misread. I don't yet know enough
>> about UBIFS to describe the issue better.
>
> Can you share the image?
>
> I hope I have something sane to release soon.
> ...being still busy with rebasing my preliminary tool to Yang's tree
> and found some issues.
>
> Thanks,
> //richard