@rgayon @joachimmetz As discussed oob, i can take a look at this (re-using docker explorer to add support in dfVFS)

When a file is "deleted" in a layer of the overlay, the driver sets the character device bit and the device number (st_dev) to 0,0.

"A whiteout is created as a character device with 0/0 device number"
ref: https://www.kernel.org/doc/html/latest/filesystems/overlayfs.html

In the ExtFileEntry class, this bit looks to be masked out:

In the StatAttribute class, support for the device number is under consideration:

@sydp you likely want to add it to

But you would need to check what the behavior on other file systems is and what functionality we would need

@sydp you likely want to add it to

dfvfs/dfvfs/vfs/ext_file_entry.py

Line 22 in 4a84328

_ENTRY_TYPES = {

But you would need to check what the behavior on other file systems is and what functionality we would need

Ah great, thanks @joachimmetz.

I'll look into it - currently only have test data for EXT4.