I have an odd problem with forensics on an SGI host. I've got a dd image of
it's two hard drives. The host OS is SGI IRIX 6.4, and the format is xfs. The
fstab does not show any seperate journaling partition or location, so I am
assuming the journaling is on the partitions with the data.
My problem is that I cannot mount the dd images on my Linux host. My analysis
host is Fedora Core 4. It klnows about xfs journaled systems, but I keep
getting the same error no matter if I try to mount the raw disk, or seperate
partions.
To mount the partitions I calculated the offset by multiplying the block size
512 by the starting offset reported from fdisk -l -u . Didn't work either, i
got the same following errors in messages.
So, any ideas on how to mount the dd image of this system?
Here's the error via mount:
mount: wrong fs type, bad option, bad superblock on /dev/loop1,
missing codepage or other error
In some cases useful info is found in syslog - try
dmesg | tail or so
Here's the error via dmesg:
SGI XFS with ACLs, security attributes, large block numbers, no debug enabled
SGI XFS Quota Management subsystem
XFS: bad magic number
XFS: SB validate failed
Thanks!
