Hi,

I have a datablock like

00000091a20a11020300000001200001
00120807003000006005000f02000f13
02230040120060010b00041000390e00
701000315100a0100080ff0001000f07
0a812c000f02000122c00d1600124707
00f3120059e3faa6970000008445c9ab
4e45000004f45ebcfa5b13007e9a783c
f6cd2f0427000f0200ffe70155020f02
00ffffffffffffffffffffffffff3050
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000

which is compressed with lz4 compression.I have both logical and physical size for this block. Is there any source code or API to decompress this block.I donot want to decompress this using command. I am working on windows 10.

Hi,

I have a data block like 0000008EA20A1102030000000120000100120C07003000004E05000F02000F13022300311200D00A00041000390E00E01000403A001001110080FF0001000F070A810C000F02000113301500133E0800F010A9DD71709100000079E205AEDD3E000086F7AEDFEA8A10006383FC5F6AA05DBC000F0200FFEB0155020F0200FFFFFFFFFFFFFFFFFFFFFFFFFF30500000000000000000000000000000000000000000000000000000000000000000000000
which is compressed with lz4 algorithm.Is there any source code or library or API by which i can decompressed this block.

I am working on deleted zpool and want to recover deleted zpool data. For this i need metadata information but all metadata is compressed by default. I am not able to read blockpointer information MOS information etc.how can i decompress metadata to read information on windows.

thanks

Hello,

I am working on internal structure of ZFS file system.I am using ubuntu 20.04. I want to reach data in zpool but some blocks are compressed with lz4 compression algorithm like MOS object_phys_t, denode array etc.I am trying to decompress data blocks using zdb but facing problem in decompressing.

It gives error " ZLE decompression was selected. If you suspect the results are wrong,
try avoiding ZLE by setting and exporting ZDB_NO_ZLE="true""..

Why this problem occurs.how can i resolve this issue .I have exported ZDB_NO_ZLE="true" using terminal but still have the same problm on decompression.
I googled a lot of thing but did not get satisfactory answer.

Hi,

zdb does not decompress zfs data block . It gives error ZLE decompression was selected. If you suspect the results are wrong,
try avoiding ZLE by setting and exporting ZDB_NO_ZLE="true"
how can i resolve this issue .I have exporting ZDB_NO_ZLE="true" but still have the same problm on decompression.

Regards,
roopa01

Hi,

 I read https://www.joyent.com/blog/zfs-forensics-recovering-files-from-a-destroyed-zpool . I want to uncompress zfs data block 

to reach the data and i follow the above links steps. How can i build this code or use binaries to run the command given in the above link.mdb commands donot run on terminal.It gives "Command 'mdb' not found, but there are 20 similar ones".error.I am running commands on ubuntu.
please help me.

thanks
roopa01

Hi,

I have a data block like 0000008EA20A1102030000000120000100120C07003000004E05000F02000F13022300311200D00A00041000390E00E01000403A001001110080FF0001000F070A810C000F02000113301500133E0800F010A9DD71709100000079E205AEDD3E000086F7AEDFEA8A10006383FC5F6AA05DBC000F0200FFEB0155020F0200FFFFFFFFFFFFFFFFFFFFFFFFFF30500000000000000000000000000000000000000000000000000000000000000000000000
which is compressed with lz4 algorthim.Is there any source code or library or API by which i can decompressed this block.

I am working on deleted zpool and want to recover deleted zpool data. For this i need metadata information but all metadata is compressed by default. I am not able to read blockpointer information MOS information etc.how can i decompress metadata to read information on windows.

thanks

Hi,

I am working on ZFS file system on ubuntu 20.04.I read about modified zdb and modified mdb to decompress data blocks.
https://www.yumpu.com/en/document/read/3947186/zfs-on-disk-data-walk-or-wheres-my-data-bruning-systems
how can we get modified zdb and mdb.

kindly help me.
Regards,
roopa01

hi,

Is this avaliable for windows ? zuncompress and mdb. I am using a zfs formated drive on windows for recovery.It is a USB drive. I dont want to use any recovery tool. I want to recover data manually.

please help me.

regards,
roopa01

Hi,
I am working on ZFS Filesystem to trace data. I got the uberblock details using zdb command:

Uberblock:
magic = 0000000000bab10c
version = 5000
txg = 54
guid_sum = 14032801381258142085
timestamp = 1607514721 UTC = Wed Dec 9 17:22:01 2020
mmp_magic = 00000000a11cea11
mmp_delay = 0
mmp_valid = 0
rootbp = DVA[0]=<0:240002200:200> DVA[1]=<0:260001e00:200> DVA[2]=<0:280005600:200> [L0 DMU objset] fletcher4 lz4 unencrypted LE contiguous unique triple size=1000L/200P birth=54L/54P fill=72 cksum=99dbf6b8d:3e3a721b723:cd24200bab2e:1cb817c85505ed
checkpoint_txg = 0
I am working on ubuntu 20.04
Zpool has lz4 compression.I moved forward according
http://www.osdevcon.org/2008/files/osdevcon2008-max.pdf
I reached on step 7 Object directory and got Fatzap object (ZBT_HEADER(0x8000000000000001)) . Now in case of fatzap object it does not have any object id further to move MOS while in case of microzap object (8000000000000003)
It has structure as follow:

0::print -a -t zfs`mzap_phys_t <-- print an mzap_phys_t
0 uint64_t mz_block_type = 0x8000000000000003...<-- output omitted
40 mzap_ent_phys_t [1] mz_chunk = [

{
40 uint64_t mze_value = 0x2 <-- object id in MOS
48 uint32_t mze_cd = 0
4c uint16_t mze_pad = 0
4e char [50] mze_name = [ "root_dataset" ]
}
Kindly tell me the structure of fatzap object.How can i move to next block from here.

Hi,

I am working on ZFS file system to trace data in zpool.I have object type
800 uint8_t dn_type = 0x14 <-- DMU_OT_DIRECTORY_CONTENTS . What is the structure of this type of object.It has bonus buffer
.So how can i read bonus buffer or what is the structure of bonus buffer and how many type of data a bonus buffer can hold like 0x2c.

Thanks
roopa01

Hello,

       I am working on ZFS file system.I am using zdb to decompress the data block. When i run zdb -uuu myPool command it gives the output like this:

roopa@Admin:~$ sudo zdb -uuu myPool
[Uberblock:
magic = 0000000000bab10c
version = 5000
txg = 107
guid_sum = 3321261512524857960
timestamp = 1600265714 UTC = Wed Sep 16 19:45:14 2020
mmp_magic = 00000000a11cea11
mmp_delay = 0
mmp_valid = 0
checkpoint_txg = 0

It does not give output like

rootbp = [L0 DMU objset] 400L/200P DVA[0]=<0:4e00:200>
DVA[1]=<0:1c0004e
00:200> DVA[2]=<0:380001200:200> fletcher4 lzjb LE contiguous
birth=19148 fill=1
8 cksum=89aca5d29:38d271ef883:be5570b26779:1af282de579a51

So i am not able to give offset of the block to be decompressed. Can you help me what is the problm with this.

But when i give manual offset of the block to be decompressed in the command

zdb -R laciedisk:c4t0d0p1:4e00:200:d,lzjb,400 2> /tmp/objset

it decompressed the block and show it on terminal nothing goes to the file /tmp/objset . This is blank file created in temp.

How can i read the given output.How can i use mdb to print the decompressed data and read it.What is the structure of this uncompressed block
data.When i use mdb command it gives error mdb command not found.Please help me and guide me.

subj