> > > Not for filesystems that store permission info, e.g., ext2,
> > > ISO9660+RockRidge, etc.
> >
> > Sometimes I wish there was a uid/gid option for ext2, too. (Doing
> > forensic analysis as root is a bit risky. ;-)
>
> Usermode Linux can mount your ext2fs block device in the virtual linux,
> and with copy on write of changes to a different file.
Usermode Linux is indeed an option, thanks for the suggestions.
BTW, which of the journaling file systems support true read-only
mounts (without replaying the journal and thus writing to disk)?
-- Florian Weimer Florian.Weimer@RUS.Uni-Stuttgart.DE University of Stuttgart http://cert.uni-stuttgart.de/ RUS-CERT +49-711-685-5973/fax +49-711-685-5898 - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/