Re: [HACKERS] Forensic recovery deleted pgdump custom format file

2015-07-14 Thread David Guimaraes
Yes Michael, I agree. This is the CloseArchive function at pg_backup_custom.c WriteHead(AH); tpos = ftello(AH->FH); WriteToc(AH); ctx->dataStart = _getFilePos(AH, ctx); WriteDataChunks(AH); This is the WriteHead function at pg_backup_archiver.c: (*AH->WriteBufPtr) (AH, "PGDMP", 5); /* Magic cod

Re: [HACKERS] Forensic recovery deleted pgdump custom format file

2015-07-13 Thread Michael Paquier
On Tue, Jul 14, 2015 at 11:20 AM, David Guimaraes wrote: > Yeah bingo Hm. While there is a magic-code header for the custom format, by looking at the code I am not seeing any traces of a similar thing at the end of the dump file (_CloseArchive in pg_backup_custom.c), and I don't recall wither tha

Re: [HACKERS] Forensic recovery deleted pgdump custom format file

2015-07-13 Thread David Guimaraes
Yeah bingo Em 13/07/2015 22:11, "Michael Paquier" escreveu: > On Tue, Jul 14, 2015 at 10:58 AM, David Guimaraes > wrote: > > The backups were deleted. I need them to use pg_restore. > > So what you mean is that you are looking at your disk at FS level to > find traces of those deleted backups by

Re: [HACKERS] Forensic recovery deleted pgdump custom format file

2015-07-13 Thread Michael Paquier
On Tue, Jul 14, 2015 at 10:58 AM, David Guimaraes wrote: > The backups were deleted. I need them to use pg_restore. So what you mean is that you are looking at your disk at FS level to find traces of those deleted backups by analyzing their binary format... Am I missing something? -- Michael -

Re: [HACKERS] Forensic recovery deleted pgdump custom format file

2015-07-13 Thread David Guimaraes
The backups were deleted. I need them to use pg_restore. Em 13/07/2015 21:18, "Michael Paquier" escreveu: > On Tue, Jul 14, 2015 at 9:28 AM, David Guimaraes > wrote: > > So I decided to try to understand the file format generated by > > pgdump. Analyzing the source code of pgdump/recovery, i con

Re: [HACKERS] Forensic recovery deleted pgdump custom format file

2015-07-13 Thread Michael Paquier
On Tue, Jul 14, 2015 at 9:28 AM, David Guimaraes wrote: > So I decided to try to understand the file format generated by > pgdump. Analyzing the source code of pgdump/recovery, i concluded a few > things: > > The header of the file always starts with "PGDMP" followed by pgdump version > number use

[HACKERS] Forensic recovery deleted pgdump custom format file

2015-07-13 Thread David Guimaraes
Hello. I need some help. I have the following situation. My client deleted a number of old backups from a drive disc made by PGDUMP with custom flag activated. I could not find any program to recover backup files made by PGDUMP of customized / binary form. So I decided to try to understand the fil