You find a string of interest at a specific byte offset in your XFS file system image. How can you convert this byte offset into an XFS block address using only the command line?
#Linux #DFIR #CommandLine #Trivia
Nov 18, 2022 · 12:40 PM UTC
1
1
2
Wow, yesterday's Linux DFIR command line trivia scared everybody off!
Let's start with this string:
6240111554 # I love bash!
Because, after all, who doesn't?
xfs_db -r -c "convert daddr $((6240111554 / 512)) fsblock" /path/to/image
Let's start… infosec.exchange/@hal_pomera…
1
1
2