[ale] Copy-on-write file?

[JK]

On 1/17/2010 11:26 AM, Michael H. Warfield wrote:

> Hmmm...  If you want to do that on the block level, about my only choice
> would be to set up an LVM partition with lots of free space in the PV
> and put your image in the file system in the LV.  Then take a snapshot
> of the LV and then go to work on your image.  If you screw something up,
> revert to the snapshot, discard the changes, redo, and repeat.


That sounds like the right answer.  Unfortunately I'll need to get another
drive to implement it -- things are getting a little crowded on the
recovery machine.


> If you want to do something on the logical file level, UnionFS /
> funionfs would probably be your best bet.  More than likely, you won't
> have the unionfs patch in your kernel so you'll need to use fuse and
> funionfs which is available in the RH/Fedora repos and should be
> available for Ubuntu as well.  Mount the file system you want to protect
> as the RO bottom directory and then specify a directory somewhere else
> as the RW top directory.  Any files that get changed, get written to the
> top directory.


If I understand correctly, this probably won't work.  I need to do
an fsck on the filesysem in the image, and I suspect that unionfs
won't play nice in this case -- fsck will have to operate on the
image file itself, and copying that entire image is what I'm trying
to avoid. Is unionfs smart enough to copy only changed blocks? or
does it always copy the whole of any changed file?  (I'm about to
read up on unionfs shortly, so that question requires no answer
unless you feel generous :-)


>> (BTW I found the ext3cow FS, which would work, but something less
>> intrusive would be awfully nice.)
>
> Not familiar with that but I doubt my suggestions are any "less
> intrusive" and LVM is a pain to set up, if you haven't done it before (I
> have and it's still a pain to set up).


ext3cow is cool -- it COWs everything and keeps the entire history of
FS changes.  You can then put timestamps in your paths (Unix epoch times,
eg "ls /home/jk at 1234567890") in order to access any file or directory as
it existed at the indicated time. I think a 2TB drive with ext3cow could
be really really useful for exploratory data recovery -- but this is
my first experience with a serious recovery effort, so my opinion
is not to be trusted.

Thanks,

-- JK


-- 
As the size of an explosion increases, the number of social situations
it is incapable of solving approaches zero. -- V, Order of the Stick