Re: Possible forensic issue with grub and RH8.0

From: Alan Hodgson (ahodgsonat_private)
Date: Fri Jan 10 2003 - 10:44:35 PST

  • Next message: Christine Siedsma: "New Digital Forensic resource"

    On Tue, Jan 07, 2003 at 07:46:12PM -0800, Hovis Chasteen wrote:
    > I changed the kernel line to read “kernel
    > /vmlinuz-2.4.18-14 ro root=/dev/hda5” (hda5 is my root
    > partition). I rebooted the system and everything is
    > now as expected.  My point here is obvious. If I had
    > installed a suspect hard drive on this stock install I
    > could be working on the original evidence and loose
    > data integrity. Not a good thing.
    > 
    > I am not sure if this is new to 8.0 or grub but I did
    > not see this in RH7.3. If anyone has a better solution
    > or can explain LABEL to me, I’m all ears.
    >
    
    LABEL is like a DOS volume label for ext2/ext3 filesystems, it allows you
    to put names on partitions instead of directly addressing them like
    /dev/hda5 ... it is nice from a sysadmin perspective because you can add and
    remove drives and partitions without having to update your fstab
    every time. 
    
    Recent versions of the ext2/ext3 tools support labels, including mount,
    fsck, etc.  See man 8 tune2fs for more details.  I guess grub supports it
    now too.
    
    -- 
    Alan
    
    -----------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Fri Jan 10 2003 - 11:52:50 PST