xfs_metadump / xfs_db metadump - output file example 506f776572204d616e6167656d656e74 "/home/lubuntu/0000000006023020544" - via "xfs_db> metadump 0000000006023020544" "/home/lubuntu/meta" - via "xfs_db> metadump -o -w -g meta" "/home/lubuntu/test.file" - empty file, deleted "/home/lubuntu/test/x" - via "lubuntu@lubuntu:~$ xfs_mdrestore -g meta test/x" probably (file meta = file /home/lubuntu/meta) /home/lubuntu/meta has strings possibly from * https://www.commonsensemedia.org/movie-reviews/kimba-the-white-lion-vol-1-the-king-is-dead-all-hail-the-king * https://www.commonsensemedia.org/movie-reviews/alice-in-wonderland-1983 * https://kodiapps.com/episode-32997-5-8 / https://kodiapps.com/episode-32997-5-7 * etc. (probably) https://duckduckgo.com/?q=get+file+from+filesystem+without+mounting+linux&t=canonical&ia=web https://unix.stackexchange.com/questions/434472/how-can-i-extract-files-from-a-disk-image-without-mounting-it https://bochs.sourceforge.io/doc/docbook/user/loop-device-usage.html https://linux.die.net/man/8/xfs_repair https://duckduckgo.com/?q=xfs_db+metadump&t=canonical&ia=web * see also: https://linux.die.net/man/8/xfs_mdrestore https://duckduckgo.com/?q=Bad+magic+number+in+super-block+while+trying+to+open+%2Fdev%2Fsdb2&t=canonical&ia=web https://duckduckgo.com/?q=%22Bad+magic+number+in+super-block+while+trying+to+open%22&t=canonical&ia=web https://linuxroutes.com/resolve-bad-magic-number-in-super-block-in-error/ https://duckduckgo.com/?q=mount+disk+image+as+loopback&t=canonical&ia=web https://duckduckgo.com/?q=mount+xfs+filesystem&t=canonical&ia=web https://duckduckgo.com/?q=mount+xfs+filesystem+as+loopback&t=canonical&ia=web https://fabianlee.org/2020/01/13/linux-mounting-a-loopback-ext4-xfs-filesystem-to-isolate-or-enforce-storage-limits/ https://fossbytes.com/loopfs-linux-file-system/ lubuntu@lubuntu:~$ sudo xfs_db /dev/sdb2 xfs_db: V1 inodes unsupported. Please try an older xfsprogs. [After installing xfsprogs_3.2.1_amd64.deb] lubuntu@lubuntu:~$ sudo xfs_db /dev/sdb2 xfs_db> help ablock filoff -- set address to file offset (attr fork) addr [field-expression] -- set current address agf [agno] -- set address to agf header agfl [agno] -- set address to agfl block agi [agno] -- set address to agi header back -- move to the previous location in the position ring blockfree -- free block usage information blockget [-s|-v] [-n] [-t] [-b bno]... [-i ino] ... -- get block usage and check consistency blockuse [-n] [-c blockcount] -- print usage for current block(s) bmap [-ad] [block [len]] -- show block map for current file convert type num [type num]... type -- convert from one address form to another daddr [d] -- set address to daddr value dblock filoff -- set address to file offset (data fork) debug [flagbits] -- set debug option bits dquot [projid|gid|uid] -- set current address to project, group or user quota block echo [args]... -- echo arguments forward -- move forward to next entry in the position ring frag [-a] [-d] [-f] [-l] [-q] [-R] [-r] [-v] -- get file fragmentation data freesp [-bcdfs] [-a agno]... [-e binsize] [-h h1]... [-m binmult] -- summarize free space for filesystem fsblock [fsb] -- set address to fsblock value hash string -- calculate hash value help [command] -- help for one or all commands inode [inode#] -- set current inode label [label] -- write/print FS label log [stop|start ] -- start or stop logging to a file metadump [-e] [-g] [-m max_extent] [-w] [-o] filename -- dump metadata to a file ncheck [-s] [-i ino] ... -- print inode-name pairs pop -- pop location from the stack print [value]... -- print field values push [command] -- push location to the stack quit -- exit xfs_db ring -- show position ring or move to a specific entry sb [agno] -- set current address to sb header source source-file -- get commands from source-file stack -- view the location stack type [newtype] -- set/show current data type uuid [uuid] -- write/print FS uuid version [feature | [vnum fnum]] -- set feature bit(s) in the sb version field Use 'help commandname' for extended help. xfs_db> blockfree block usage information not allocated xfs_db> ring no entries in location ring. xfs_db> stack xfs_db> freesp from to extents blocks pct 1 1 1377 1377 0.05 2 3 1997 4888 0.16 4 7 3785 20880 0.70 8 15 28879 353533 11.83 16 31 309 7014 0.23 32 63 142 6113 0.20 64 127 76 6941 0.23 128 255 62 11240 0.38 256 511 47 17278 0.58 512 1023 37 27396 0.92 1024 2047 16 20596 0.69 2048 4095 8 20868 0.70 4096 8191 8 42414 1.42 8192 16383 3 28629 0.96 16384 32767 1 31388 1.05 65536 131071 5 580227 19.41 131072 245869 11 1808334 60.50 xfs_db> inode no current inode xfs_db> ncheck must run blockget -n first xfs_db> blockget -n ^C ^[ ^C^C^C^C^C ^[[A^[[C^C^[^[^[ ^[ escape ^[ quit xfs_db> xfs_db> escape xfs_db> xfs_db> quit lubuntu@lubuntu:~$ sudo xfs_db /dev/sdb2 xfs_db> inode 14025 xfs_db> frag ^[[B^[[B^[[B actual 421942, ideal 214279, fragmentation factor 49.22% xfs_db> hash bad argument count 0 to hash, expected 1 arguments xfs_db> metadump xfs_db: too few options for metadump (no filename given) xfs_db> metadump 0000000006023020544 xfs_db> exit command exit not found xfs_db> quit lubuntu@lubuntu:~$ ls 0000000006023020544 Desktop Documents Downloads Music Pictures Public Templates Videos lubuntu@lubuntu:~$ ls -liah total 136M 25937 drwxr-xr-x 15 lubuntu lubuntu 440 May 31 01:44 . 16878 drwxr-xr-x 1 root root 60 May 31 01:07 .. 234 -rw------- 1 lubuntu lubuntu 52 May 31 01:07 .Xauthority 52 -rw-r--r-- 1 lubuntu lubuntu 220 May 31 01:07 .bash_logout 54 -rw-r--r-- 1 lubuntu lubuntu 3.7K May 31 01:07 .bashrc 26668 drwx------ 9 lubuntu lubuntu 240 May 31 01:14 .cache 25938 drwxr-xr-x 8 lubuntu lubuntu 220 May 31 01:13 .config 25960 drwx------ 3 lubuntu lubuntu 60 May 31 01:07 .gnupg 25965 drwx------ 3 lubuntu lubuntu 60 May 31 01:07 .local 31706 drwx------ 5 lubuntu lubuntu 100 May 31 01:11 .mozilla 55 -rw-r--r-- 1 lubuntu lubuntu 807 May 31 01:07 .profile 337 -rw-r--r-- 1 lubuntu lubuntu 0 May 31 01:08 .sudo_as_admin_successful 232 -rw------- 1 lubuntu lubuntu 2.7K May 31 01:07 .xsession-errors 428 -rw-r--r-- 1 root root 136M May 31 01:45 0000000006023020544 26162 drwxr-xr-x 2 lubuntu lubuntu 140 May 31 01:07 Desktop 27224 drwxr-xr-x 2 lubuntu lubuntu 40 May 31 01:07 Documents 27218 drwxr-xr-x 2 lubuntu lubuntu 60 May 31 01:15 Downloads 27226 drwxr-xr-x 2 lubuntu lubuntu 40 May 31 01:07 Music 27228 drwxr-xr-x 2 lubuntu lubuntu 40 May 31 01:07 Pictures 27222 drwxr-xr-x 2 lubuntu lubuntu 40 May 31 01:07 Public 27220 drwxr-xr-x 2 lubuntu lubuntu 40 May 31 01:07 Templates 27230 drwxr-xr-x 2 lubuntu lubuntu 40 May 31 01:07 Videos lubuntu@lubuntu:~$ pwd /home/lubuntu lubuntu@lubuntu:~$ vim 0000000006023020544 lubuntu@lubuntu:~$ sudo xfs_db /dev/sdb2 xfs_db> help [...] Use 'help commandname' for extended help. xfs_db> metadump --help metadump: invalid option -- '-' xfs_db: bad option for metadump command xfs_db> metadump -h metadump: invalid option -- 'h' xfs_db: bad option for metadump command xfs_db> ncheck 14025 must run blockget -n first xfs_db> help metadump metadump [-e] [-g] [-m max_extent] [-w] [-o] filename -- dump metadata to a file The 'metadump' command dumps the known metadata to a compact file suitable for compressing and sending to an XFS maintainer for corruption analysis or xfs_repair failures. Options: -e -- Ignore read errors and keep going -g -- Display dump progress -m -- Specify max extent size in blocks to copy (default = 1000 blocks) -o -- Don't obfuscate names and extended attributes -w -- Show warnings of bad metadata information xfs_db> echo a a xfs_db> metadump -o -w -g meta Copying log xfs_db> echo https://linux.die.net/man/8/xfs_metadump xfs_db> exit xfs_db> quit lubuntu@lubuntu:~$ ls 0000000006023020544 Desktop Documents Downloads Music Pictures Public Templates Videos meta lubuntu@lubuntu:~$ md5sum 0000000006023020544 84d52c9022ead8f9a43dd1e5bd1f8ae0 0000000006023020544 lubuntu@lubuntu:~$ sha1sum 0000000006023020544 4fb3f63ada8f60a7f36ceb509fbb90159d4b2a3e 0000000006023020544 lubuntu@lubuntu:~$ md5sum meta bb9a3783b747721227f16b92d4924d01 meta lubuntu@lubuntu:~$ sha1sum meta abf42c88db90e2a0ac5e2909bbbca4a844cbe5fc meta lubuntu@lubuntu:~$ echo "xfs_metadump is a shell wrapper around the xfs_db(8) metadump command." [...] lubuntu@lubuntu:~$ sudo xfs_repair -n /dev/sdb2 Phase 1 - find and verify superblock... xfs_repair: filesystem has a realtime subvolume xfs_repair: realtime device init failed xfs_repair: cannot repair this filesystem. Sorry. lubuntu@lubuntu:~$ debugfs debugfs 1.44.6 (5-Mar-2019) debugfs: debugfs: debugfs: exit debugfs: Unknown request "exit". Type "?" for a request list. debugfs: quit lubuntu@lubuntu:~$ debugfs --help debugfs 1.44.6 (5-Mar-2019) debugfs: invalid option -- '-' debugfs: Usage: debugfs [-b blocksize] [-s superblock] [-f cmd_file] [-R request] [-d data_source_device] [-i] [-n] [-D] [-V] [[-w] [-z undo_file] [-c]] [device] lubuntu@lubuntu:~$ echo https://unix.stackexchange.com:443/questions/434472/how-can-i-extract-files-from-a-disk-image-without-mounting-it [...] lubuntu@lubuntu:~$ ls 0000000006023020544 Desktop Documents Downloads Music Pictures Public Templates Videos meta lubuntu@lubuntu:~$ debugfs -f <(echo cat /viewer/segments/Rcrd-03-18-2015-1027-08-10405-ch501-min65535-src2.mpg/0000000006023020544) /dev/sdb2 | tail -n +2 > test.file debugfs 1.44.6 (5-Mar-2019) debugfs: Permission denied while trying to open /dev/sdb2 cat: Filesystem not open lubuntu@lubuntu:~$ sudo debugfs -f <(echo cat /viewer/segments/Rcrd-03-18-2015-1027-08-10405-ch501-min65535-src2.mpg/0000000006023020544) /dev/sdb2 | tail -n +2 > test.file debugfs 1.44.6 (5-Mar-2019) debugfs: Bad magic number in super-block while trying to open /dev/sdb2 /dev/fd/63: No such file or directory lubuntu@lubuntu:~$ lsblk -t NAME ALIGNMENT MIN-IO OPT-IO PHY-SEC LOG-SEC ROTA SCHED RQ-SIZE RA WSAME loop0 0 512 0 512 512 1 mq-deadline 256 128 0B sda 0 512 0 512 512 1 mq-deadline 2 128 0B ├─sda1 0 512 0 512 512 1 mq-deadline 2 128 0B └─sda2 0 512 0 512 512 1 mq-deadline 2 128 0B sdb 0 512 0 512 512 1 mq-deadline 64 128 0B ├─sdb1 0 512 0 512 512 1 mq-deadline 64 128 0B ├─sdb2 0 512 0 512 512 1 mq-deadline 64 128 0B └─sdb3 0 512 0 512 512 1 mq-deadline 64 128 0B sr0 0 512 0 512 512 1 mq-deadline 64 128 0B zram0 0 4096 4096 4096 4096 0 128 128 0B zram1 0 4096 4096 4096 4096 0 128 128 0B lubuntu@lubuntu:~$ lsblk -f NAME FSTYPE LABEL UUID FSAVAIL FSUSE% MOUNTPOINT loop0 squashfs 0 100% /rofs sda iso9660 Lubuntu 19.04 amd64 2019-04-16-19-13-46-00 0 100% /cdrom ├─sda1 iso9660 Lubuntu 19.04 amd64 2019-04-16-19-13-46-00 └─sda2 vfat Lubuntu 19.04 amd64 039E-EF17 sdb ├─sdb1 swap [SWAP] ├─sdb2 xfs a870119e-1278-4c3c-a075-5793bde4788d └─sdb3 sr0 zram0 [SWAP] zram1 [SWAP] lubuntu@lubuntu:~$ ls 0000000006023020544 Desktop Documents Downloads Music Pictures Public Templates Videos meta test.file lubuntu@lubuntu:~$ xxd test.file lubuntu@lubuntu:~$ xxd test.fil xxd: test.fil: No such file or directory lubuntu@lubuntu:~$ sudo debugfs -f <(echo cat viewer/segments/Rcrd-03-18-2015-1027-08-10405-ch501-min65535-src2.mpg/0000000006023020544) /dev/sdb2 | tail -n +2 > test.file debugfs 1.44.6 (5-Mar-2019) debugfs: Bad magic number in super-block while trying to open /dev/sdb2 /dev/fd/63: No such file or directory lubuntu@lubuntu:~$ xxd test.file lubuntu@lubuntu:~$ ["xfs_mdrestore -g meta test/x" was ran] lubuntu@lubuntu:~$ ls 0000000006023020544 1.txt Desktop Documents Downloads Music Pictures Public Templates Videos meta test test.file lubuntu@lubuntu:~$ cd test lubuntu@lubuntu:~/test$ ls x lubuntu@lubuntu:~/test$ ls -liah total 134M 95376 drwxrwxr-x 2 lubuntu lubuntu 60 May 31 02:23 . 25937 drwxr-xr-x 16 lubuntu lubuntu 560 May 31 02:23 .. 471 -rw-rw-r-- 1 lubuntu lubuntu 16G May 31 02:21 x lubuntu@lubuntu:~/test$ lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT loop0 7:0 0 1.5G 1 loop /rofs sda 8:0 0 29.8G 0 disk /cdrom ├─sda1 8:1 0 1.6G 0 part └─sda2 8:2 0 3.7M 0 part sdb 8:16 0 465.8G 0 disk ├─sdb1 8:17 0 517.7M 0 part [SWAP] ├─sdb2 8:18 0 15G 0 part └─sdb3 8:19 0 450.3G 0 part sr0 11:0 1 1024M 0 rom zram0 252:0 0 1.3G 0 disk [SWAP] zram1 252:1 0 1.3G 0 disk [SWAP] lubuntu@lubuntu:~/test$ losetup /dev/loop1 x losetup: /dev/loop1: failed to set up loop device: Permission denied lubuntu@lubuntu:~/test$ sudo losetup /dev/loop1 x lubuntu@lubuntu:~/test$ lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT loop0 7:0 0 1.5G 1 loop /rofs loop1 7:1 0 15G 0 loop sda 8:0 0 29.8G 0 disk /cdrom ├─sda1 8:1 0 1.6G 0 part └─sda2 8:2 0 3.7M 0 part sdb 8:16 0 465.8G 0 disk ├─sdb1 8:17 0 517.7M 0 part [SWAP] ├─sdb2 8:18 0 15G 0 part └─sdb3 8:19 0 450.3G 0 part sr0 11:0 1 1024M 0 rom zram0 252:0 0 1.3G 0 disk [SWAP] zram1 252:1 0 1.3G 0 disk [SWAP] lubuntu@lubuntu:~/test$ cd .. lubuntu@lubuntu:~$ cd .. lubuntu@lubuntu:/home$ cd .. lubuntu@lubuntu:/$ ;s bash: syntax error near unexpected token `;' lubuntu@lubuntu:/$ ls bin cdrom etc initrd.img lib lib64 media opt rofs run snap sys usr vmlinuz boot dev home initrd.img.old lib32 libx32 mnt proc root sbin srv tmp var vmlinuz.old lubuntu@lubuntu:/$ cd media/ lubuntu@lubuntu:/media$ ls cdrom lubuntu lubuntu@lubuntu:/media$ cd lu bash: cd: lu: No such file or directory lubuntu@lubuntu:/media$ cd lubuntu/ lubuntu@lubuntu:/media/lubuntu$ ls lubuntu@lubuntu:/media/lubuntu$ mkdir xf mkdir: cannot create directory ‘xf’: Permission denied lubuntu@lubuntu:/media/lubuntu$ sudo mkdir xf lubuntu@lubuntu:/media/lubuntu$ sudo mount /dev/loop1 xf mount: /media/lubuntu/xf: wrong fs type, bad option, bad superblock on /dev/loop1, missing codepage or helper program, or other error. lubuntu@lubuntu:/media/lubuntu$ lubuntu@lubuntu:/media/lubuntu$ echo this is dumb this is dumb lubuntu@lubuntu:/media/lubuntu$ lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT loop0 7:0 0 1.5G 1 loop /rofs loop1 7:1 0 15G 0 loop sda 8:0 0 29.8G 0 disk /cdrom ├─sda1 8:1 0 1.6G 0 part └─sda2 8:2 0 3.7M 0 part sdb 8:16 0 465.8G 0 disk ├─sdb1 8:17 0 517.7M 0 part [SWAP] ├─sdb2 8:18 0 15G 0 part └─sdb3 8:19 0 450.3G 0 part sr0 11:0 1 1024M 0 rom zram0 252:0 0 1.3G 0 disk [SWAP] zram1 252:1 0 1.3G 0 disk [SWAP] lubuntu@lubuntu:/media/lubuntu$ fdisk -l fdisk: cannot open /dev/loop0: Permission denied fdisk: cannot open /dev/loop1: Permission denied fdisk: cannot open /dev/sda: Permission denied fdisk: cannot open /dev/sdb: Permission denied fdisk: cannot open /dev/zram0: Permission denied fdisk: cannot open /dev/zram1: Permission denied lubuntu@lubuntu:/media/lubuntu$ sudo losetup -d /dev/loop1 lubuntu@lubuntu:/media/lubuntu$ sudo fdisk -l Disk /dev/loop0: 1.5 GiB, 1589342208 bytes, 3104184 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disk /dev/sda: 29.8 GiB, 32015679488 bytes, 62530624 sectors Disk model: Cruzer Glide Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: dos Disk identifier: 0x0f9be39a Device Boot Start End Sectors Size Id Type /dev/sda1 * 0 3237695 3237696 1.6G 0 Empty /dev/sda2 3211356 3218843 7488 3.7M ef EFI (FAT-12/16/32) Disk /dev/sdb: 465.8 GiB, 500107862016 bytes, 976773168 sectors Disk model: WDC WD5000AVVS-6 Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: dos Disk identifier: 0x00000000 Device Boot Start End Sectors Size Id Type /dev/sdb1 64 1060289 1060226 517.7M 82 Linux swap / Solaris /dev/sdb2 1060296 32531624 31471329 15G 83 Linux /dev/sdb3 32531632 976768064 944236433 450.3G 83 Linux Disk /dev/zram0: 1.3 GiB, 1421402112 bytes, 347022 sectors Units: sectors of 1 * 4096 = 4096 bytes Sector size (logical/physical): 4096 bytes / 4096 bytes I/O size (minimum/optimal): 4096 bytes / 4096 bytes Disk /dev/zram1: 1.3 GiB, 1421402112 bytes, 347022 sectors Units: sectors of 1 * 4096 = 4096 bytes Sector size (logical/physical): 4096 bytes / 4096 bytes I/O size (minimum/optimal): 4096 bytes / 4096 bytes lubuntu@lubuntu:/media/lubuntu$ echo offset = bytes per sector * sectors per cylinder offset = bytes per sector xf sectors per cylinder lubuntu@lubuntu:/media/lubuntu$ echo bytes/sector=512 I guess bytes/sector=512 I guess lubuntu@lubuntu:/media/lubuntu$ echo /dev/sdb2 has 31471329 sector (=amount of sectors/cylinder?) bash: syntax error near unexpected token `(' lubuntu@lubuntu:/media/lubuntu$ echo 512*31471329 !wolf = 16113320448 bash: !wolf: event not found lubuntu@lubuntu:/media/lubuntu$ sudo losetup /dev/loop1 /home/lubuntu/test/x -o 16113320448 losetup: /home/lubuntu/test/x: failed to set up loop device: Resource temporarily unavailable lubuntu@lubuntu:/media/lubuntu$ lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT loop0 7:0 0 1.5G 1 loop /rofs sda 8:0 0 29.8G 0 disk /cdrom ├─sda1 8:1 0 1.6G 0 part └─sda2 8:2 0 3.7M 0 part sdb 8:16 0 465.8G 0 disk ├─sdb1 8:17 0 517.7M 0 part [SWAP] ├─sdb2 8:18 0 15G 0 part └─sdb3 8:19 0 450.3G 0 part sr0 11:0 1 1024M 0 rom zram0 252:0 0 1.3G 0 disk [SWAP] zram1 252:1 0 1.3G 0 disk [SWAP] lubuntu@lubuntu:/media/lubuntu$ sudo losetup /dev/loop1 /home/lubuntu/test/x lubuntu@lubuntu:/media/lubuntu$ lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT loop0 7:0 0 1.5G 1 loop /rofs loop1 7:1 0 15G 0 loop sda 8:0 0 29.8G 0 disk /cdrom ├─sda1 8:1 0 1.6G 0 part └─sda2 8:2 0 3.7M 0 part sdb 8:16 0 465.8G 0 disk ├─sdb1 8:17 0 517.7M 0 part [SWAP] ├─sdb2 8:18 0 15G 0 part └─sdb3 8:19 0 450.3G 0 part sr0 11:0 1 1024M 0 rom zram0 252:0 0 1.3G 0 disk [SWAP] zram1 252:1 0 1.3G 0 disk [SWAP] lubuntu@lubuntu:/media/lubuntu$ sudo losetup -d /dev/loop1 lubuntu@lubuntu:/media/lubuntu$ md5sum /home/lubuntu/test/x 550eb00d72399874629b403e099b9ff0 /home/lubuntu/test/x lubuntu@lubuntu:/media/lubuntu$ sha1sum /home/lubuntu/test/x 0dc7caaf3cfff174b5756fa59943f44f30f78ec2 /home/lubuntu/test/x lubuntu@lubuntu:/media/lubuntu$ lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT loop0 7:0 0 1.5G 1 loop /rofs sda 8:0 0 29.8G 0 disk /cdrom ├─sda1 8:1 0 1.6G 0 part └─sda2 8:2 0 3.7M 0 part sdb 8:16 0 465.8G 0 disk ├─sdb1 8:17 0 517.7M 0 part [SWAP] ├─sdb2 8:18 0 15G 0 part └─sdb3 8:19 0 450.3G 0 part sr0 11:0 1 1024M 0 rom zram0 252:0 0 1.3G 0 disk [SWAP] zram1 252:1 0 1.3G 0 disk [SWAP] lubuntu@lubuntu:/media/lubuntu$ sudo mount -o loop,rw /home/lubuntu/test/x xf mount: /media/lubuntu/xf: wrong fs type, bad option, bad superblock on /dev/loop1, missing codepage or helper program, or other error. lubuntu@lubuntu:/media/lubuntu$ lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT loop0 7:0 0 1.5G 1 loop /rofs sda 8:0 0 29.8G 0 disk /cdrom ├─sda1 8:1 0 1.6G 0 part └─sda2 8:2 0 3.7M 0 part sdb 8:16 0 465.8G 0 disk ├─sdb1 8:17 0 517.7M 0 part [SWAP] ├─sdb2 8:18 0 15G 0 part └─sdb3 8:19 0 450.3G 0 part sr0 11:0 1 1024M 0 rom zram0 252:0 0 1.3G 0 disk [SWAP] zram1 252:1 0 1.3G 0 disk [SWAP] lubuntu@lubuntu:~/test$ md5sum x 550eb00d72399874629b403e099b9ff0 x lubuntu@lubuntu:~/test$ sha1sum x 0dc7caaf3cfff174b5756fa59943f44f30f78ec2 x lubuntu@lubuntu:~/test$ stat x File: x Size: 16113270784 Blocks: 275200 IO Block: 4096 regular file Device: 19h/25d Inode: 471 Links: 1 Access: (0664/-rw-rw-r--) Uid: ( 999/ lubuntu) Gid: ( 999/ lubuntu) Access: 2021-05-31 02:22:18.452474914 +0000 Modify: 2021-05-31 02:21:48.152006671 +0000 Change: 2021-05-31 02:21:48.152006671 +0000 Birth: - lubuntu@lubuntu:~/test$ stat x.tar.xz File: x.tar.xz Size: 20238092 Blocks: 39528 IO Block: 4096 regular file Device: 19h/25d Inode: 796 Links: 1 Access: (0664/-rw-rw-r--) Uid: ( 999/ lubuntu) Gid: ( 999/ lubuntu) Access: 2021-05-31 03:54:00.885333745 +0000 Modify: 2021-05-31 03:46:44.897638524 +0000 Change: 2021-05-31 03:46:44.897638524 +0000 Birth: - lubuntu@lubuntu:~/test$ md5sum x.tar.xz f83585ae0551b3fed7a0a85252fbeda4 x.tar.xz lubuntu@lubuntu:~/test$ sha1sum x.tar.xz c031d24b48f014953c740a605c61614cd585e079 x.tar.xz lubuntu@lubuntu:~/test$ echo file "x.tar.xz" contains file "x" file x.tar.xz contains file x lubuntu@lubuntu:~/test$ sha256sum x.tar.xz 4ad55e4530ff194b9ec520320331501ad9721004880ca4993cf0145be888e3a8 x.tar.xz lubuntu@lubuntu:~/test$ mv x .. & date [1] 4907 Mon May 31 03:56:03 UTC 2021 lubuntu@lubuntu:~/test$ mv x.tar.xz ..&date [2] 4911 Mon May 31 03:56:10 UTC 2021 [1] Done mv x .. lubuntu@lubuntu:~/test$ cd .. [2]+ Done mv x.tar.xz .. (wd: ~/test) (wd now: ~) lubuntu@lubuntu:~$ stat test File: test Size: 40 Blocks: 0 IO Block: 4096 directory Device: 1ah/26d Inode: 95376 Links: 2 Access: (0775/drwxrwxr-x) Uid: ( 999/ lubuntu) Gid: ( 999/ lubuntu) Access: 2021-05-31 03:56:06.946409965 +0000 Modify: 2021-05-31 03:56:10.290438546 +0000 Change: 2021-05-31 03:56:10.290438546 +0000 Birth: - lubuntu@lubuntu:~$ rm test & date [1] 4914 Mon May 31 03:56:27 UTC 2021 rm: cannot remove 'test': Is a directory lubuntu@lubuntu:~$ rm -r test & date [2] 4917 Mon May 31 03:56:33 UTC 2021 [1] Exit 1 rm test lubuntu@lubuntu:~$ rm x &date [3] 4931 Mon May 31 03:56:51 UTC 2021 [2] Done rm -r test lubuntu@lubuntu:~$ stat test.file File: test.file Size: 0 Blocks: 0 IO Block: 4096 regular empty file Device: 19h/25d Inode: 431 Links: 1 Access: (0664/-rw-rw-r--) Uid: ( 999/ lubuntu) Gid: ( 999/ lubuntu) Access: 2021-05-31 02:11:17.667343840 +0000 Modify: 2021-05-31 02:11:13.827315293 +0000 Change: 2021-05-31 02:11:13.827315293 +0000 Birth: - [3]+ Done rm x lubuntu@lubuntu:~$ rm test.file&date [1] 4940 Mon May 31 03:57:09 UTC 2021 lubuntu@lubuntu:~$ stat meta File: meta Size: 142232064 Blocks: 277800 IO Block: 4096 regular file Device: 19h/25d Inode: 430 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2021-05-31 01:51:46.293877426 +0000 Modify: 2021-05-31 01:51:04.897483049 +0000 Change: 2021-05-31 01:51:04.897483049 +0000 Birth: - [1]+ Done rm test.file lubuntu@lubuntu:~$ stat 0000000006023020544 File: 0000000006023020544 Size: 142232064 Blocks: 277800 IO Block: 4096 regular file Device: 19h/25d Inode: 428 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2021-05-31 01:45:41.390061812 +0000 Modify: 2021-05-31 01:45:01.329583702 +0000 Change: 2021-05-31 01:45:01.329583702 +0000 Birth: - lubuntu@lubuntu:~$ stat /home/lubuntu/Downloads/xfsprogs_3.2.1_amd64.deb File: /home/lubuntu/Downloads/xfsprogs_3.2.1_amd64.deb Size: 702552 Blocks: 1376 IO Block: 4096 regular file Device: 19h/25d Inode: 447 Links: 1 Access: (0664/-rw-rw-r--) Uid: ( 999/ lubuntu) Gid: ( 999/ lubuntu) Access: 2021-05-31 01:15:11.164746967 +0000 Modify: 2021-05-31 01:15:07.672733094 +0000 Change: 2021-05-31 01:15:07.684733141 +0000 Birth: - lubuntu@lubuntu:~$ md5sum /home/lubuntu/Downloads/xfsprogs_3.2.1_amd64.deb 8a63d6d386c7c0b72d083b0b7c838141 /home/lubuntu/Downloads/xfsprogs_3.2.1_amd64.deb lubuntu@lubuntu:~$ sha1sum /home/lubuntu/Downloads/xfsprogs_3.2.1_amd64.deb ea66a3cdb73d725c2401fa23fdbf5e649b81587b /home/lubuntu/Downloads/xfsprogs_3.2.1_amd64.deb lubuntu@lubuntu:~$ sha256sum /home/lubuntu/Downloads/xfsprogs_3.2.1_amd64.deb f817db6cc4276a6401c3b4c50dd99bb69443a70bd06a527a896062d49886e94b /home/lubuntu/Downloads/xfsprogs_3.2.1_amd64.deb lubuntu@lubuntu:~$ sha512sum /home/lubuntu/Downloads/xfsprogs_3.2.1_amd64.deb 3ddb6d74d77a18f9913d16f5b46ca64f1873cb959fd30819c924c07997ec76cd58b8a2de87ee7629c1044496f97d4355e214484c58237f56c9cd87fc16a5d46f /home/lubuntu/Downloads/xfsprogs_3.2.1_amd64.deb lubuntu@lubuntu:~$ rm /home/lubuntu/Downloads/xfsprogs_3.2.1_amd64.deb lubuntu@lubuntu:~$ date Mon May 31 03:59:22 UTC 2021 lubuntu@lubuntu:~$ stat 0000000006023020544 File: 0000000006023020544 Size: 142232064 Blocks: 277800 IO Block: 4096 regular file Device: 19h/25d Inode: 428 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2021-05-31 01:45:41.390061812 +0000 Modify: 2021-05-31 01:45:01.329583702 +0000 Change: 2021-05-31 01:45:01.329583702 +0000 Birth: - lubuntu@lubuntu:~$ md5sum 0000000006023020544 84d52c9022ead8f9a43dd1e5bd1f8ae0 0000000006023020544 lubuntu@lubuntu:~$ sha1sum 0000000006023020544 4fb3f63ada8f60a7f36ceb509fbb90159d4b2a3e 0000000006023020544 lubuntu@lubuntu:~$ sha256sum 0000000006023020544 47f458c5e03e92dba422f3a902ebadf433e2e5d19e6df701033319c55bfa85d4 0000000006023020544 lubuntu@lubuntu:~$ sha512sum 0000000006023020544 dc5743f0c9970cb3b6c4800beb7c2888cace6a83721a48e724f1fff453ea5c0ebd3a31753fc62b5a6538125207ccd932272314c3f3bea9213433e8a72c66c127 0000000006023020544 lubuntu@lubuntu:~$ stat /home/lubuntu/Downloads/0.tar.xz File: /home/lubuntu/Downloads/0.tar.xz Size: 19091816 Blocks: 37296 IO Block: 4096 regular file Device: 19h/25d Inode: 447 Links: 1 Access: (0664/-rw-rw-r--) Uid: ( 999/ lubuntu) Gid: ( 999/ lubuntu) Access: 2021-05-31 04:00:35.404989469 +0000 Modify: 2021-05-31 04:01:36.461611223 +0000 Change: 2021-05-31 04:01:36.461611223 +0000 Birth: - lubuntu@lubuntu:~$ md5sum /home/lubuntu/Downloads/0.tar.xz a8c5d75169c60a81cac12c58c4cf83a3 /home/lubuntu/Downloads/0.tar.xz lubuntu@lubuntu:~$ sha1sum /home/lubuntu/Downloads/0.tar.xz 1ba04c79b61d57d772466eedf3b4598dae5e6d15 /home/lubuntu/Downloads/0.tar.xz lubuntu@lubuntu:~$ echo file 0.tar.xz contains file 0000000006023020544 file 0.tar.xz contains file 0000000006023020544 lubuntu@lubuntu:~$ sha224sum /home/lubuntu/Downloads/0.tar.xz eb977ebdcca516597245872b7bdfd87d175b63e2f17adbfb7fd946df /home/lubuntu/Downloads/0.tar.xz lubuntu@lubuntu:~$ sha256sum /home/lubuntu/Downloads/0.tar.xz 33b091fd2dea66da2288e696c9acb900b8ffd2e6efa9c5786ca1552987497637 /home/lubuntu/Downloads/0.tar.xz lubuntu@lubuntu:~$ rm 0000000006023020544 &date [1] 5228 Mon May 31 04:05:44 UTC 2021 lubuntu@lubuntu:~$ rm: remove write-protected regular file '0000000006023020544'? [1]+ Stopped rm 0000000006023020544 lubuntu@lubuntu:~$ sudo rm 0000000006023020544 &date [2] 5235 Mon May 31 04:06:00 UTC 2021 lubuntu@lubuntu:~$ mv /home/lubuntu/Downloads/0.tar.xz . [2]- Done sudo rm 0000000006023020544 lubuntu@lubuntu:~$ pwd /home/lubuntu lubuntu@lubuntu:~$ ls 0.tar.xz 1.txt Desktop Documents Downloads Music Pictures Public Templates Videos meta x.tar.xz lubuntu@lubuntu:~$ binwalk meta > binwalk_installed_by_python3_setup.py_install.txt lubuntu@lubuntu:~$ echo binwalk installed without optional (I think) dependencies. [...] lubuntu@lubuntu:~$ dd if=meta of=meta_offset_0x4FE1A13.png skip=83761683 bs=1 count=105268 105268+0 records in 105268+0 records out 105268 bytes (105 kB, 103 KiB) copied, 0.470834 s, 224 kB/s lubuntu@lubuntu:~$ xxd meta_offset_0x4FE1A13.png | more 00000000: 8950 4e47 0d0a 1a0a 0000 000d 4948 4452 .PNG........IHDR 00000010: 0000 01d4 0000 0050 0806 0000 00a0 7184 .......P......q. 00000020: 1600 0000 1974 4558 7453 6f66 7477 6172 .....tEXtSoftwar 00000030: 6500 4164 6f62 6520 496d 6167 6552 6561 e.Adobe ImageRea 00000040: 6479 71c9 653c 0000 577a 4944 4154 78da dyq.e<..WzIDATx. 00000050: ecbd 3b92 6dc9 ae24 16be aa14 2aa4 51a6 ..;.m..$....*.Q. 00000060: 4433 aa34 a359 4b3d 008e 8113 a0ce 99f4 D3.4.YK=........ 00000070: 2038 090a 1c09 d59e 4786 b34e ee15 0177 8......G..N...w 00000080: 00b1 f35b 9fd7 95d7 de7d b7ea 9ccc bdd7 ...[.....}...... 00000090: 2722 0038 1cee bf93 1cd7 7ff9 afff c318 '".8............ 000000a0: e3ff fae3 bfff e98f fffe 4fe3 d77f 8091 ..........O..... 000000b0: ff53 ffe4 e33f f1f4 6770 fe03 74bf 87f7 .S...?..gp..t... 000000c0: 7c2e d23f 5efd dfaf ffe1 fdcf c43b 6e07 |..?^........;n. 000000d0: ed67 0cde ff82 f5cf f7bf b2bf e6fd 47b8 .g............G. 000000e0: 9e3f 0fe2 70ab 977f 37e4 7fef 3fc3 af2f .?..p...7...?../ 000000f0: 67fe 65c6 3fdd ffb8 5f3b fd03 a897 a4ff g.e.?..._;...... 00000100: 42be fe2d f466 ef0f 43fe a5b9 6e83 fbef B..-.f..C...n... 00000110: d627 3f7e 64fa f7dc bfc6 7dad 8f7f 815d .'?~d.....}....] 00000120: f4fd 09a4 bf82 fbef c6eb b5ad 4ba3 def2 ............K... 00000130: fd77 8feb 7afd 14cc f859 ea5d fffa 19ee .w..z....Y.].... 00000140: 0bfb f5d9 e0dc df83 7ddf ebbb e7e3 b3a9 ........}....... 00000150: 0f8c fbeb 713f b3b8 66c6 f5ad a772 7ffe ....q?..f....r.. 00000160: 7e7f f7cf ebef e9ff 627d c7c8 d7fe 78ae ~.......b}....x. 00000170: 637d 1ef5 19c8 67bd fef3 8c75 b0ef 6dee c}....g....u..m. 00000180: f704 723f f3f8 8e39 f4ab c7fd 67af b73d ..r?...9....g..= 00000190: f5b1 3cae 71dd d7eb 33e0 88df b7d7 f262 ..<.q...3......b 000001a0: ef37 1e0b efbf e35e 7bfe 2ca6 adb3 fdfb .7.....^{.,..... 000001b0: fb77 677a c68c 67ab 0b7e ce58 73fb 1af2 .wgz..g..~.Xs... 000001c0: f38c 7f87 7cf7 7e7e bc3f 7f3d cc39 fdf7 ....|.~~.?.=.9.. 000001d0: bb77 a35b 6b4e d91f 6b0d c775 3cde 87bf .w.[kN..k..u<... 000001e0: afbd 3ed6 bab6 bd33 c73a 02f6 cf52 d7ed ..>....3.:...R.. 000001f0: 9435 b8de 55f7 1c63 add8 8b9f fa02 5f5e .5..U..c......_^ 00000200: 7f05 e98c 8957 f1f2 783e 90e7 c7d8 b390 .....W..x>...... 00000210: 3d1d a74a eccd bd9e 28ef 71f8 9902 b9f3 =..J....(.q..... 00000220: c77e 1b8f b56c db2a 9e2d 4ff7 d9fe 67bf .~...l.*.-O...g. 00000230: ffff f18f fffe cf8f 8f79 7dc9 fcfd 8f60 .........y}....` 00000240: fabf fef1 4fff cf0e a4ff e6ff b0f9 77bc ....O.........w. 00000250: f377 9177 44fa e7f7 fc3e 0f9f f59e 7c65 .w.wD....>....|e 00000260: 5d2b eccc 90bf bf3c 78a5 ef59 3984 df32 ]+...... 00000280: 7dab 481f 531e 0147 0af0 8c5b 86c7 989a }.H.S..G...[.... 00000290: aee8 9d4d 4f24 c0fd f7a4 07c0 9d65 5ce3 ...MO$.......e\. 000002a0: 1154 ef4d 7e9f 92e9 5eee 0d2a 27d7 0e6c .T.M~...^..*'..l 000002b0: c4eb df63 0751 dc57 3f23 504f 4450 58cf ...c.Q.W?#PODPX. xfs_metadump xfs metadump xfs_db xfs db identifier from xxd of plain text file "unattended.list" which was probably stored in "/home/lubuntu/.cache/lxqt-notificationd/", 00000160