3 ms·
Considering even with logging off: journaling file systems, "user assist", device connection logs, pre-fetch (or your OS's equivalent)- these are all huge tranc
by Kostchei 10y ago
Considering even with logging off: journaling file systems, "user assist", device connection logs, pre-fetch (or your OS's equivalent)- these are all huge tranches of data if you are looking at a system shortly after an event. Ask me 6 months later- probably not. Give me a system that hasn't even rebooted, has a heap of ram and hasn't been used much since- 6 weeks is fine, not ideal, but doable.
- valleyer 10y agoJournaling filesystems don't "journal" all the activity in perpetuity. They typically just journal the changes until they're committed to disk, usually for less than a second. See http://www.nobius.org/~dbg/practical-file-system-design.pdf http://www.nobius.org/~dbg/practical-file-system-design.pdf, section 7.2 "How Does Journaling Work?".