1. File system and file structures
Ext2 & Ext3 File Systems
File system and file structures

2. Three+ Optional Feature Categories
Compatible features
OS can mount even if it doesn’t support these
Incompatible features
The OS shouldn’t mount if it doesn’t support these
Read-only compatible features
Should mount as read-only if not supported
Experimental features
Can be anything added to the kernel

3. Structures File System Files and Directories
Superblock describes the file system
Group descriptor describes a block group
Block groups are consecutive sectors that store …
Files and Directories
Directory entry points to an inode in the inode table
Inode table stores inode pointers
An inode describes a directory or file or contains the data

4. The Superblock 2 sectors (1024 bytes) that describe the file system
Volume label
Block size
# blocks per group
# reserved blocks before the 1st block group
The superblock block group number
Count of free inodes & blocks (total all groups)
An Ext* block is similar to a FAT* cluster

5. Superblock Locations
1st superblock is1024 bytes past the beginning of the file system
Copies of the superblock are in the first block of each block group
Read-only compatible
Sparse superblock  not all block groups backup the superblock
The default

6. Group Descriptor Table
Stores
The group descriptors
One for each block group
Starting block addresses
block bitmap
inode bitmap
inode table
Count of free inodes & blocks for the group
Located in the block after the superblock
Backup copies are in the same block groups as the superblock backups

7. Block Group Layout
Boot sectors (2) may precede the superblock (1st block group)
Backup Super Block
Group Desc Table
Block Bitmap
Inode Bitmap
Inode Table
File Content

8. Block Bitmap One bit per block in the group
 size = #blocks / 8
Linux creates a block group to have as many blocks as there are bits in a block
Thus, a block bitmap is always 1 block in size
Tracks block allocation for the group

9. Inode Bitmap Tracks the allocation of inodes in the group
Size = #inodes per group / 8
Size defined at file system creation
Typically fewer inodes than blocks per group

10. Inode Table Size = # inodes * 128 bytes (inode size)
Inodes contain file and directory metadata
Directory has file/directory name and pointer to inode in the table
Inode points to the file content blocks

11. File System Analysis Size = block size * #blocks Features
If < volume size  volume slack
hidden data?
Features
Read-only compatible
Sparse superblock  not all blocks backup the superblock
The default

12. Superblock Analysis Always 1024 bytes from start of file system
1st 1024 reserved for boot code
hidden data?
Crucial, since it describes the key file system data structures
Superblock signature: 0xEF53 in bytes 56 & 57
Backup copies  equally spaced signatures
Sparse superblock feature  not in every group
Features flags indicate special features
Lots of free space in superblock
Hidden data?

13. Finding Superblock Copies (I)
sigfind –l ef53 disk-8.dd
Block size: 512 Offset: 56
Block: (-)
Block: (+17016)
Block: (+37636)
Block: (+24237)
Distances aren’t powers of two & they aren’t evenly spaced  don’t appear to be superblock copies
Example from “File System Forensic Analysis”, Brian Carrier, Addison-Wesley, 2005

14. Finding Superblock Copies (II)
[deleted a lot here]
Block: ( )
Block: (+16384)
Block: (+32768)
Block: (+32768)
Block: (+32768)
Block: (+32768)
Looks like superblock is in sector

15. Finding Superblock Copies (III)
Distances aren’t powers of two & they aren’t evenly spaced  don’t appear to be superblock copies

16. Ext 2 vs. Ext 3 Inter-compatible Ext3 adds journaling for consistency
Ext2 converts to Ext3
Ext3 can be read by Ext2
Ext3 adds journaling for consistency
Journal is a small, circular area written before writing to the disk
After crash, read the journal to ensure all write operations were completed
Redo any that were not completed

17. Finding Superblock Copies (IV)
[deleted a lot here]
Block: (+2800)
Block: (+3278)
Block: (+1066)
Block: (+31702)
Block: (+32768)
Block: (+32768)
Block: (+32768)
Seems like we might have some superblocks???

18. Effects of Journaling
The superblock is journaled, just like any other data, when backup copies are made
This creates a multitude of signatures in the journal
We check the superblock copy and find
It is from an Ext3 file system
The block group number is 3
Thus, block group 0 must be 49,152 sectors earlier, at sector 2,265,167 just after the end of the prior file system