Mark Furner wrote: > Hi > > Am not sure who to address this query to, there is no list for ZFS forensics > (yet). I'm looking at a DD dump of a VTOC partition containing a ZFS test > file system, follow the Uberblock DVAs to 3 separate locations (ditto blocks, > as expected) but don't find an object I can recognise. It should be the MOS, > which is type objset_phys_t, ie. it starts with a dnode, followed by a > zil_header_t and a uint64_t os_type. However, I can't see a dnode in this, > can someone help me to interpret this?
Make sure you have the correct uberblock; there are many and you have to find the one with the most recent txg. The uberblock almost certainly points to a compressed block; you need to check the compressed bit in the blkptr_t. --matt
