You find a string of interest at a specific byte offset in your XFS file system image. How can you convert this byte offset into an XFS block address using only the command line? #Linux #DFIR #CommandLine #Trivia
1
1
2
Wow, yesterday's Linux DFIR command line trivia scared everybody off! Let's start with this string: 6240111554 # I love bash! Because, after all, who doesn't? xfs_db -r -c "convert daddr $((6240111554 / 512)) fsblock" /path/to/image Let's start… infosec.exchange/@hal_pomera…

Hal Pomeranz (@hal_pomeranz@infosec.exchange)

Wow, yesterday's Linux DFIR command line trivia scared everybody off! Let's start with this string: 6240111554 # I love bash! Because, after all, who doesn't? xfs_db -r -c "convert daddr $((6240111...

infosec.exchange

Nov 19, 2022 · 2:36 PM UTC

1
1
2
Replying to @hal_pomeranz
I was like, "first construct a reverse disk map database by recursive descent and ioctl(fiemap)", but xfs_db is TIL.
1