0 days from the last btrfs-induced outage.

This time: "No space left on device" errors; df shows 518GB available. df -i shows unlimited inodes. Why out of disk space then? I ran out of "metadata" space. Fixable with: `btrfs balance start -dusage=0 /`

It's like defrag from DOS 6.2.

I look forward to wiping #btrfs out of my infrastructure. I haven't had a filesystem this needy since FAT16.

Note to self, next time run the hashing before deduplicating the data using #bees

#btrfs

#viernesdeescritorio
Después de mucho tiempo, finalmente hubo un cambio, un GRAN cambio

Tengo Artix Linux, con btrfs como sistema de archivos, OpenRC de init system, KDE como gestor de ventanas, una tera de espacio, y casi todas las aplicaciones instaladas como AppImages

Este momento de mi vida es definitivamente felicidad  

#linux #desktop #appimage #btrfs #openrc #kde #plasma67 #artix #nosystemd

On today's episode of #BTRFS mistakes!

You probably know that on mechanical disk, especially you should store your Databases and Disk Images with the No CoW attribute set on them.

What I DIDN'T know was that with Sparse VM Disks, even if that attribute is set..., as the image grows, it will fragment IMMENSELY with use. You don't necessarily get a guarantee that the data will be written next to the other data with a sparse file apparently.

I was taught this lesson by a 27000+ fragment VM Disk holding 21 GB of data... very ow.

Thankfully fixable with `cp --sparse=never old.img new.img` and just replacing the old image, but yeah no. Mistakes were made, lessons learned.

🚨 I'm teaching SANS FOR577: Linux Incident Response & Threat Hunting in Virginia Beach, VA August 24-29, this will be the first public run with completely updated course material.

What's new:

🪨 Expanded btrfs coverage — not just artifacts, but the tools you can actually use to examine disk images containing btrfs filesystems. Btrfs is now the default on Fedora, openSUSE, and increasingly Ubuntu. If you've hit that tooling gap during a real investigation, this is for you.

🧪 All-new labs - rebuilt from the ground up

🏁 New capstone - a comprehensive, updated challenge that ties the course together

🤖 AI Investigations - a brand new section covering:

* LLM evidence artifacts
* Coding assistant forensics
* AI Agents & MCP (Model Context Protocol)
* Prompt injection attacks and how to investigate them

AI tools are already embedded in attacker workflows and user environments alike. Knowing how to find and interpret AI-related evidence is becoming a core DFIR skill.

🎤 Free SANS @night Talk — Aug 26 @ 6:00 PM
"Extending Protocol-SIFT to Linux" — Protocol-SIFT has been Windows-only. We're changing that.

💰 Save $500 with Early Bird code EarlyBirdNA — must pay by July 9, 2026

📍 Hilton Virginia Beach Oceanfront
📅 August 24-29, 2026

🔗 Register: https://www.sans.org/cyber-security-training-events/virginia-beach-2026

#DFIR #SANS #FOR577 #LinuxForensics #IncidentResponse #ThreatHunting #AIForensics #PromptInjection #btrfs #Cybersecurity #DigitalForensics #InfoSec #GLIR

#Btrfs Now Enables Large Folios By Default, Lands Huge Folios With #Linux 7.2

https://www.phoronix.com/news/Linux-7.2-Btrfs

3 kleine Helfer: BTRFS-Kompression

https://tube.tchncs.de/w/ffD9RD3ZbnjCLrfLAaxPyo