Re: Importing IBM AIX5.2 rootvg from physicaldrive to> linuxbox

Jakub,

> We have access to the rawdevice but on the linux-box we haven't any access 
> to the volume group rootvg or even to the logical-volumes. did anyone have 
> done something similiar?

No, I have not done something similar. But I would guess that the reason for
your problems could be that AIX5.2 uses a different lvm scheme than Linux.

> How it could be possible to start a lvm an import such rootvg from the 
> physicaldrive to start a grave-robber? help would be apreciated!

Even if you could get to the rootvg, in my opinion this would not help you
because TCT currently does not understand either jfs or jfs2, the two
filesystems you can choose from in AIX5. They are very different from the UFS
filesystem that TCT supports on Solaris and *BSD.

If you were desparate and wanted to mount your AIX file system using JFS for
Linux(usually not a good idea to mount a suspect FS), that again will not
work, because JFS for Linux is again different from JFS or JFS2 on AIX5.x (I
have programmed a prototype version of TSK that supports JFS for Linux, but
not for AIX (yet), so again no luck for you :-)

What I did for an HP-UX box a few years ago was to port TCT to HP-UX. This
worked fine for those parts of the grave-robber that collects process memory,
network information, MAC timestamps of allocated files etc, but TCT low level
file system access was only possible for partitions which used HFS, HPs
version of UFS. But nowadays HP-UX uses vxfs as the default file system, which
like JFS/JFS2 is not compatible to UFS. So you could do the same, but you
would end up in a very similar situation like me,
with only partial TCT functionality.

Normally I would recommend that you use something easy to port like MACrobber
(see http://www.sleuthkit.org/mac-robber/index.php, it is a C version of
"grave-robber -m" ) on the suspect system itself to at least retrieve the MAC
timestamps of allocated files from your suspect system. But from your
description it appears that you have already shut down the AIX machine and
removed the harddrive. Putting the harddrive back in an booting up would mean
that more MAC timestamps get trampled upon (some may already be changed during
your shutdown, unless you yanked the power cord or stopped the system with a
controlled core-dump).

That leaves you with the final option: Attach your suspect harddrive to
another AIX system, mount the file systems from the suspect rootvg read-only,
and then run MACrobber against them. Doing it on AIX instead of Linux
means you have support for understanding the volume groups and mounting
the JFS file system.

Best regards,

Knut