On Sunday 27 March 2011, Charles Manning wrote:
> On Sunday 27 March 2011 06:17:40 Serguei Miridonov wrote:
> > Hello,
> > 
> > Probably this question has been answered somewhere but,
> > unfortunately, I could not find a simple solution with a working
> > C source...
> > 
> > The situation: I have a dump from a MTD partition which contains
> > a YAFFS2 filesystem. Assuming I have no knowledge of neither
> > data block size, nor chunk size, how can I scan the dump file to
> > find a full data directory? Is there a C source doing that?
> > 
> > I could find various versions of unyaffs program but it seems
> > they have hardcoded page and spare sizes. None of them could
> > autodetect YAFFS2 filesystem properties, retrieve
> > files/directories from some images of YAFFS2 filesystem, etc.
> > 
> > Any idea?
> > 
> > Thanks in advance.
> 
> Hello Serguei
> 
> If you know what device you have you should be able to get the mtd
> code for that device (it should be available under GPL) and be
> able to see what the parameters are.
> 
> If you do a hex dump of the dump file you should be able to
> determine the page size and binary layout that way too. With that
> knowledge you should be able to tweak something like unyaffs until
> it understands your binary layout.

Hello  Charles,

Thank you for replying. What are the key parameters of mtd device 
which are necessary to start the scanning? I know that page size is 
4096 bytes. With hex dump I can see object headers and data chunks. 
But I could not find anything like spare areas, so I don't even know 
where tags, like objectId, are located.

With some partitions it is a minor problem. For example, the Android 
"system" partition, which it typically mounted read-only, still has 
well conserved structure. But even with this partition I could only 
guess that my assumption that this block sequence (header-data) is 
correct, so I can trust headers and the following data, and count 
objects to derive objectIds. With other partitions, like "userdata" it 
is a major problem because it is virtually impossible to decipher the 
file or directory status without tags from (nonexistent?) spare areas.

Does it mean that I need to scan entire partition to recover headers 
with the same file names and parent IDs to find the most recent mtime 
stamps? How should I find objectIds to find directories which are 
parents for those objects with known parentObjectIDs?

Do you have a manual or a program which can recover file system from 
the mtd partiton dump? Is it at all possible?

Thank you.

Serguei.