What I am seeing is a lot of mysterious activity on one of the files.
The operations that I can understand from my test program are the following. My program reads the modification times of both files, opens both files, closes both files, and reads the modification times of both files to check for changes.
10:20:33.680604 stat64 /Volumes/PF/Hancock Purchase/Settlement.pdf 10:20:33.680634 stat64 /Volumes/PF/Hancock Purchase/Deed.pdf
10:20:35.747890 open F=28 (R_____) /Volumes/PF/Hancock Purchase/Deed.pdf 10:20:35.747895 fstat64 F=28 10:20:35.748081 open F=29 (R_____) /Volumes/PF/Hancock Purchase/Settlement.pdf 10:20:35.748083 fstat64 F=29 10:20:35.748143 close F=29 10:20:35.748163 stat64 /Volumes/PF/Hancock Purchase/Settlement.pdf 10:20:35.748221 close F=28 10:20:35.748234 stat64 /Volumes/PF/Hancock Purchase/Deed.pdf
However, in the gap above between 680634 and 747890 there is much activity on the Deed.pdf file.
Here are some samples:
10:20:33.730020 pread F=5 B=0x6000 O=0x0854c000 0.015156 W diskimages-helpe.1498506 10:20:33.730261 RdData[AN] D=0x00043128 B=0x6000 /dev/disk3s2 /Volumes/PF/Hancock Purchase/Deed.pdf 0.015420 W java.1499251 10:20:33.730596 RdData[ANT1P] D=0x18d7dee8 B=0x1000 /dev/disk2s11 /Volumes/L/P/PF (original) copy.sparseimage 0.000307 W diskimages-help.1498506
10:20:33.765099 pread F=5 B=0x2000 O=0x0872f000 0.000260 W diskimages-helpe.1498506 10:20:33.765159 RdData[AN] D=0x00043840 B=0x2000 /dev/disk3s2 /Volumes/PF/Hancock Purchase/Deed.pdf 0.050276 W java.1499251 10:20:33.765318 WrData[SN] D=0x000d47b8 B=0x20000 /dev/disk3s2 /Volumes/PF/Hancock Purchase/Deed.pdf 0.000070 W java.1499251 10:20:33.765631 WrData[SNT1P] D=0x1cdf9bf8 B=0x1000 /dev/disk2s11 /Volumes/L/P/PF (original) copy.sparseimage 0.000238 W diskimages-help.1498506 10:20:33.765666 HFS_update (___cam) 0.000016 diskimages-helpe.1498506
10:20:33.922951 pread F=5 B=0x6000 O=0x05fea000 0.015490 W diskimages-helpe.1498506 10:20:33.923178 RdData[AN] D=0x0000c618 B=0x6000 /dev/disk3s2 /Volumes/PF/Hancock Purchase/Deed.pdf 0.031607 W java.1499251 10:20:33.924641 RdData[ANT1P] D=0x18b091e8 B=0x1a000 /dev/disk2s11 /Volumes/L/P/PF (original) copy.sparseimage 0.001435 W diskimages-help.1498506 10:20:33.924659 pread F=5 B=0x1a000 O=0x05ff2000 0.001469 W diskimages-helpe.1498506 10:20:33.925251 RdData[AN] D=0x0000c658 B=0x1a000 /dev/disk3s2 /Volumes/PF/Hancock Purchase/Deed.pdf 0.033669 W java.1499251 10:20:33.925400 WrData[SN] D=0x000d49b8 B=0x20000 /dev/disk3s2 /Volumes/PF/Hancock Purchase/Deed.pdf 0.000052 W java.1499251 10:20:33.928220 WrData[ANT1P] D=0x1cdf9df8 B=0x20000 /dev/disk2s11 /Volumes/L/P/PF (original) copy.sparseimage 0.002050 W diskimages-help.1498506 10:20:33.928258 HFS_update (___cam) 0.000016 diskimages-helpe.1498506
I don’t know why this is happening or what is being written.
On Feb 6, 2014, at 10:11 AM, Jim Luther < email@hidden> wrote: The fs_usage command is handy for seeing what file system activity might be cause behaviors you see.
sudo fs_usage -w -f filesys
And then look for accesses to your file in the output. You can see all of the command's options with:
man 1 fs_usage
- Jim
On Feb 6, 2014, at 9:39 AM, Mark Day <email@hidden> wrote:
I'll bet it's related to checksums. DMG files can have a checksum, used to detect whether the DMG contents were corrupted in transport. If I remember correctly, the Disk Images subsystem will verify the checksum the first time you use that image, and then mark it (with an extended attribute?) so that it won't have to verify the checksum again. I'll bet the modification is it marking the image as being known to match its checksum.
-Mark
On Feb 6, 2014, at 9:30 AM, Alan Snyder <email@hidden> wrote:
I’ve run into an odd situation involving specific files in two specific encrypted sparse disk images. I open two files for reading and then close them. The file that is closed first has its modification time updated as if it had been modified. The behavior is repeatable if I start with (a copy of) the same DMG files. However, the problem only occurs once in the mounted file system. I’m guessing there is some kind of corruption in the disk image files that is resolved when the files are closed.
Please tell me this problem was discovered and fixed a while ago… :-)
|