Messages in this thread | | | Subject | Re: Add a norecovery option to ext3/4? | From | Valdis.Kletnieks@vt ... | Date | Mon, 09 Apr 2007 09:42:19 -0400 |
| |
On Sun, 08 Apr 2007 22:24:50 CDT, Eric Sandeen said: > Can you elaborate? Under what circumstances is log replay going to harm > data? Do you mean that the installer mounts partitions, looking for > what OS is installed? How is that harmful?
Another usage case that really wants to avoid the log replay is if you're looking at an unknown disk image with a forensics CD such as Helix:
http://www.e-fense.com/helix/
Yes, good forensics always clones the disk image twice (the first clone being used for nothing but creating second-gen clones for analysis), and in most cases the forensic analyst can work around the fact that you *do* cause some changes to the disk image by mounting. But sometimes, you'd rather be looking at a possibly inconsistent image than replaying the log - particularly if you're looking at a "seized and power plug pulled" image, and you actually care about things that may have been in the log, like just-erased files. [unhandled content-type:application/pgp-signature] | |