[ale] mounted filesystem becomes read-only

[Greg Freemyer]

sometimes if the kernel sees fs corruption it will internally set a fs
to readonly.

check your kernel logs

On Fri, Jun 11, 2010 at 8:12 AM, Geoffrey <lists at serioustechnology.com> wrote:
> I don't get this.  I have a mounted file system that I just created a vm
> on via vmware player.  It's never been unmounted, yet if I try to create
> a file on it I get:
>
> touch foo
> touch: cannot touch `foo': Read-only file system
>
> More weirdness:
>
> root at mac/media/vmware> mount|grep vmware
> /dev/sdb3 on /media/vmware type ext3 (rw)
>
> The OS clearly thinks it's a writable file system.
>
> Clues anyone?????
>
> I can't unmount it either as it says it's busy, and I'm pretty sure that
> has something to do with vmware:
>
> ps aux|grep vmware
> root      2837  0.0  0.0  18552   884 ?        Ss   Jun09   0:00
> /usr/bin/vmware-usbarbitrator
> root      2926  0.0  0.0  10980   156 ?        Ss   Jun09   0:00
> /usr/bin/vmnet-dhcpd -s 6 -cf /etc/vmware/vmnet1/dhcpd/dhcpd.conf -lf
> /etc/vmware/vmnet1/dhcpd/dhcpd.leases -pf
> /var/run/vmnet-dhcpd-vmnet1.pid vmnet1
> root      2949  0.0  0.0  10980   540 ?        Ss   Jun09   0:00
> /usr/bin/vmnet-dhcpd -s 6 -cf /etc/vmware/vmnet8/dhcpd/dhcpd.conf -lf
> /etc/vmware/vmnet8/dhcpd/dhcpd.leases -pf
> /var/run/vmnet-dhcpd-vmnet8.pid vmnet8
> root      2955  0.0  0.0   9116   964 ?        S    Jun09   0:37
> /usr/bin/vmnet-natd -s 6 -m /etc/vmware/vmnet8/nat.mac -c
> /etc/vmware/vmnet8/nat/nat.conf
> esoteric 14124  0.0  0.0   2852   780 ?        S<   Jun10   0:00
> /usr/lib/vmware/bin/thnuclnt -pdir /tmp/vmware-esoteric/thnuclnt-14114 -fg
> esoteric 14126  0.0  0.0  11304   980 ?        S<   Jun10   0:00
> /usr/lib/vmware/bin/thnuclnt -pdir /tmp/vmware-esoteric/thnuclnt-14114 -fg
> esoteric 14128  0.0  0.0  57468   248 ?        S<   Jun10   0:00
> /usr/lib/vmware/bin/thnuclnt -pdir /tmp/vmware-esoteric/thnuclnt-14114 -fg
> esoteric 14129  0.0  0.0  57472   224 ?        S<   Jun10   0:00
> /usr/lib/vmware/bin/thnuclnt -pdir /tmp/vmware-esoteric/thnuclnt-14114 -fg
>
>
> --
> Until later, Geoffrey
>
> "I predict future happiness for America if they can prevent
> the government from wasting the labors of the people under
> the pretense of taking care of them."
> - Thomas Jefferson
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://mail.ale.org/mailman/listinfo/ale
> See JOBS, ANNOUNCE and SCHOOLS lists at
> http://mail.ale.org/mailman/listinfo
>



-- 
Greg Freemyer
Head of EDD Tape Extraction and Processing team
Litigation Triage Solutions Specialist
http://www.linkedin.com/in/gregfreemyer
CNN/TruTV Aired Forensic Imaging Demo -
   http://insession.blogs.cnn.com/2010/03/23/how-computer-evidence-gets-retrieved/

The Norcross Group
The Intersection of Evidence & Technology
http://www.norcrossgroup.com