On Thu, Aug 18, 2016 at 05:09:28PM -0400, Renaud OLGIATI wrote: > On Thu, 18 Aug 2016 22:48:39 +0200 > "Dr. Nikolaus Klepp" <[email protected]> wrote: > > > > Not sure, but could you try to also mount the disk with the noatime > > > option. I don't know if ro implies noatime. > > > > I remember an article in german "Linuxmagazin" ~ 10 Jears ago where it > > said that the stock kernel drivers for all journaling file systems on > > linux are broken for forensic analysis due to the fact that these > > drivers always update the journal despite the filesystem mounted read > > only. Looks like that statement is still true. > > > > The workaround given that time was to make a image of the whole device, > > make that image immutable, and mount the partions of that image. > > Would mounting as ext2 (non journaling) help in that case ?
You can't mount ext4 as ext2 because of extents and a bunch of other features. To disable journal recovery mount with -oro,norecovery, very recently a bunch of filesystems either gained this option or aliased their existing options (like nologreplay) to that. -- An imaginary friend squared is a real enemy. _______________________________________________ Dng mailing list [email protected] https://mailinglists.dyne.org/cgi-bin/mailman/listinfo/dng
