2026-10-16 04:39 UTC
Now that I understand it fully, I'll build a forensic analysis tool in Rust to recover prior versions of the database by reversing allocator operations.
Much information is leaked through the slack data in freed blocks, the string copying patterns, and the ordering of the free lists. I hope to be able to construct a tree of possible operations that could have produced a form letter database.
With this, I may be able to refine my estimate of when UNIX was requested by the U.
3/6
Replies (1)
-
@thalia@discuss.systems 2026-10-16 04:39
But why does form/fed implement an allocator? Now, we'd just load all the key/value pairs into memory, process, and dump, especially for a database so small. But memory was expensive and the PDP-11/20 had only 56KB. Instead, it uses a file as the backing store and reads 512-byte blocks on demand, caching up to four of them, and flushing when evicted. It implements a buddy allocator with a full suite of functions, including coalescing and resizing. This was well before the standard library started to take form, so it was all bespoke to form/fed. 4/6