ext3 on encrypted device mapper

ext3 on encrypted device mapper

[Anonymous via the Cypherpunks Tonga Remailer]

Hi,

i'm using a linux debian sarge on an encrypted root filesystem with linux 2.6.10-rc2 kernel.

Filesystem is encrypted using dmcrypt, the encryption framework working on top of the device mapper.

I deleted a file and immediatelly i attempted to recover it using debugfs.

Linux aaa 2.6.10-rc2 #1 Wed Dec 1 09:52:37 CET 2004 i686 GNU/Linux

aaa:~# df -k .
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/mapper/rootfs     8676440   5278584   2957108  65% /

aaa:~# debugfs /dev/mapper/rootfs
debugfs 1.35 (28-Feb-2004)
debugfs:  lsdel

aaa:~# strings /dev/mapper/rootfs
strings: Warning: '/dev/mapper/rootfs' is not an ordinary file

Unfortunatelly neither with debugfs neither with a rogue strings i can access data on the encrypted filesystem.

I think that device mapper should be modified to allow debugfs checking and to allow access on it like a tradional hard drive.

Regards

--aaa

Re: ext3 on encrypted device mapper

[Andreas Dilger]

[-- Attachment #1: Type: text/plain, Size: 943 bytes --]

On Dec 02, 2004  19:17 +0100, Anonymous via the Cypherpunks Tonga Remailer wrote:
> Filesystem is encrypted using dmcrypt, the encryption framework working on top of the device mapper.
> 
> I deleted a file and immediatelly i attempted to recover it using debugfs.
> 
> Linux aaa 2.6.10-rc2 #1 Wed Dec 1 09:52:37 CET 2004 i686 GNU/Linux
> 
> aaa:~# df -k .
> Filesystem           1K-blocks      Used Available Use% Mounted on
> /dev/mapper/rootfs     8676440   5278584   2957108  65% /
> 
> aaa:~# debugfs /dev/mapper/rootfs
> debugfs 1.35 (28-Feb-2004)
> debugfs:  lsdel

Ext3 doesn't allow file undeleting (though the data on disk is not
overwritten in any way, just the metadata).  You should be happy, this
is more secure (seems you are worried about that).

Cheers, Andreas
--
Andreas Dilger
http://sourceforge.net/projects/ext2resize/
http://members.shaw.ca/adilger/             http://members.shaw.ca/golinux/


[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]