1

Is there a way I can use dd or another tool to view the binary contents of free disk space in CentOS? In case it matters, it's a Linux logical volume with XFS format, holding data only (not a common system volume such as / or /var).

Some process had filled one of the volumes with a single output file, when the file was expected to be small. To unblock the host's services, the file was deleted and a reboot was needed. I want to dump a few megabytes from a few places on the now-freed disk space, so I can examine the binary data and see if there was some sort of infinite looping error text/data in hopes of finding and addressing the root cause.

frazierjason
  • 11
  • 1

1 Answers1

1

The easiest is probably indeed with dd.

dd if=/dev/VG_NAME/LV_NAME of=/tmp/partition.data skip=500M bs=1M count=5

will skip the first 500 Megabytes of raw data from the block device and then copy out count=5 * 1 Megabyte of raw data to the filename specified with of.

Read and repeat with different offsets.

Bob
  • 5,805
  • 7
  • 25
  • Thanks, but I had only wanted to read some chunks of free partition space, while this proposal reads volume data indiscriminately based on the offset. Is there a way to only select data from unused partition space? – frazierjason Dec 07 '20 at 04:51