On Sunday 27 March 2011, Charles Manning wrote:
> On Sunday 27 March 2011 06:17:40 Serguei Miridonov wrote:
> > Hello,
> >
> > Probably this question has been answered somewhere but,
> > unfortunately, I could not find a simple solution with a working
> > C source...
> >
> > The situation: I have a dump from a MTD partition which contains
> > a YAFFS2 filesystem. Assuming I have no knowledge of neither
> > data block size, nor chunk size, how can I scan the dump file to
> > find a full data directory? Is there a C source doing that?
> >
> > I could find various versions of unyaffs program but it seems
> > they have hardcoded page and spare sizes. None of them could
> > autodetect YAFFS2 filesystem properties, retrieve
> > files/directories from some images of YAFFS2 filesystem, etc.
> >
> > Any idea?
> >
> > Thanks in advance.
>
> Hello Serguei
>
> If you know what device you have you should be able to get the mtd
> code for that device (it should be available under GPL) and be
> able to see what the parameters are.
>
> If you do a hex dump of the dump file you should be able to
> determine the page size and binary layout that way too. With that
> knowledge you should be able to tweak something like unyaffs until
> it understands your binary layout.
Hello Charles,
Thank you for replying. What are the key parameters of mtd device
which are necessary to start the scanning? I know that page size is
4096 bytes. With hex dump I can see object headers and data chunks.
But I could not find anything like spare areas, so I don't even know
where tags, like objectId, are located.
With some partitions it is a minor problem. For example, the Android
"system" partition, which it typically mounted read-only, still has
well conserved structure. But even with this partition I could only
guess that my assumption that this block sequence (header-data) is
correct, so I can trust headers and the following data, and count
objects to derive objectIds. With other partitions, like "userdata" it
is a major problem because it is virtually impossible to decipher the
file or directory status without tags from (nonexistent?) spare areas.
Does it mean that I need to scan entire partition to recover headers
with the same file names and parent IDs to find the most recent mtime
stamps? How should I find objectIds to find directories which are
parents for those objects with known parentObjectIDs?
Do you have a manual or a program which can recover file system from
the mtd partiton dump? Is it at all possible?
Thank you.
Serguei.
(text/plain)