Simulation experiment of locating process of EXT2 file file

Http://linux.chinaunix.net/techdoc/system/2008/09/19/1033277.shtml

EXT2 file Localization Process simulation experiment (no theory version)
Copyright:
Gnu
Author Information:
Alin Fang (Fang Yunlin)
Msn:
Cst05001@hotmail.com
G Talk:
[Email=cst05001%ef%bc%a0gmail.com]cst05001@[/email]
[Email=cst05001%ef%bc%a0gmail.com]gmail.com[/email]
Blog
http://www.alinblog.cn
Date Modified:
6 Aug, 2008
Objective of the experiment:
The purpose of making this note
1. For the sake of forgetting
2. To share with you
Theory:
The hard drive is like a big room. The data is like a lump of books.
How to put these books in the room is your freedom.
But when you're looking for the book you want, how long will it take, you'll be at your peril (-__-)
How much time you need to find the book you want, a big factor depends on the way you put the book. At least most people should think so.
For example, I can have so many ways to put books:
Stacked the books neatly in the house

Buy a closet, sort the books into a closet.

Buy a few closet stacks of books, and then do a library like the index card, put in the room, if you need a book, you can first through the index card to determine where the book is probably placed

Hard drive, like the room of this pile of books.
The file system is the way you manage these books.
Here are some ideas to explain:
Block (Blocks):
Ext2 the smallest unit in which the file system data region stores data.
Specified when the file system is created.
I have a block of 1024byte here.
Inode:
Each inode has a 0x80 byte.
The information recorded in it includes:
The location of the file within the partition (in block).
Record this position in the Inode's 41-44byte.
Inode structure under Tutu:

This diagram is referenced from: http://homepage.smc.edu/morgan_david/cs40/analyze-ext2.htm
Directory (catalog):
A directory is a special kind of file that records the Inode, type, file name length, filename of the file under that directory.
Ordinary files are recorded as plain data.
Some definitions:
The inode number of the top-level directory for the partition is 2
0x80 (16) = = 128 (10)
0x400 (16) = = 1024 (10)
0x800 (16) = = 2048 (10)
Group descriptors:Group Descriptor. The specific contents are shown in the following table:







4




1




4




Block number of
Block bitmap






4




5




8




Block number of
Inode bitmap






4




9




12




Block number of the in-a-inode table block






2




13




14




Number of free
Blocks in the group






2




15




16




Number of free
Inodes in the group






2




17




18




Number of
Directories in the group






2




19




20




Alignment to Word






4




21st




24




Nulls to pad out bytes



Note: This form is copied from Quner's experimental notes.
Group
Descriptorsthe first9-12Byte records the firstInodeabsolute position of the table on the file system(to Blockas a unit)
File location Process:

Find Group
Descriptors, get Inode
The location of the table
=> Find the Inode
Table location, determine the top-level directory inode, determine the location of the directory data area
=> find the top-level directory to determine which to locate.
Experiment steps:
Virtual out of a file system:
root@alin:/root# DD If=/dev/zero of=disk.img
Bs=1m count=1
1+0 Records in
1+0 Records out
1048576 bytes (1.0 MB) copied, 0.00320471 s,
327 MB/s
root@alin:/root# mkfs.ext2 disk.img
MKE2FS 1.40.8 (13-mar-2008)
Disk.img is isn't a block special device.
Proceed anyway? (y,n) Y
FileSystem label=
OS Type:linux
Block size=1024 (log=0)
Fragment size=1024 (log=0)
128 Inodes, 1024 blocks
Wuyi Blocks (4.98%) reserved for the super
User
The Data block=1
Maximum filesystem blocks=1048576
1 Block Group
8192 blocks per group, 8192 fragments per
Group
128 Inodes per group
Writing Inode Tables:done

Writing Superblocks and filesystem
Accounting Information:done
This filesystem would be automatically
Checked every mounts or
180 days, whichever comes. Use
Tune2fs-c or-i to override.
root@alin:/root# mkdir mnt
root@alin:/root# Mount-o Loop disk.img mnt/
root@alin:/root# mkdir mnt/dir1/
root@alin:/root# echo Fangyunlin >
Mnt/dir1/name
root@alin:/root# echo 15011424628 >
Mnt/phone
root@alin:/root# Umount mnt/
root@alin:/root#

Let's look at some of the properties of this file system:
root@alin:/root# tune2fs-l disk.img
TUNE2FS 1.40.8 (13-mar-2008)
FileSystem Volume Name:
Last mounted on:
FileSystem UUID:
f9211136-1617-4fe1-9336-ae637a1bc057
FileSystem Magic Number:0xef53
FileSystem Revision #: 1 (dynamic)
FileSystem features:ext_attr
Resize_inode Dir_index filetype Sparse_super
FileSystem Flags:
Signed_directory_hash
Default mount options: (None)
FileSystem State:clean
Errors behavior:continue
FileSystem OS Type:linux
Inode count:128
Block count:1024
Reserved Block count:51
Free blocks:983
Free inodes:114
The Block:1
Block size:1024
Fragment size:1024
Reserved GDT Blocks:3
Blocks per group:8192
Fragments per group:8192
Inodes per group:128
Inode blocks per group:16
FileSystem Created:sat Sep 6
14:18:15 2008
Last Mount Time:sat Sep 6
14:19:21 2008
Last Write Time:sat Sep 6
14:20:35 2008
Mount count:1
Maximum Mount Count:24
Last Checked:sat Sep 6
14:18:15 2008
Check interval:15552000 (6
Months
Next Check After:thu Mar 5
14:18:15 2009
Reserved blocks uid:0 (user root)
Reserved blocks gid:0 (group root)
The Inode:11
Inode size:128
Default Directory Hash:tea
Directory Hash Seed:
8847abf9-9ae7-4eeb-bfb9-92df433c42a7
root@alin:/root#
root@alin:/root#
We found the block of this ext2 file system
The size is 1024 (byte). i.e. 0x400 (16)
To comb again:
An inode size is 0x80
A block
Size is 0x400
OK, then start to simulate file positioning.
We use the 16-in editor to open the mirrors we made with the Ext2 file system.
Three 16-in-editor editors are recommended here:
Khexedit
Ghex
Hexdump
I use Khexedit myself.
root@alin:/root# Khexedit Disk.img &
[1] 21238
root@alin:/root#
We jump to the 0x800 position, that group
The position of the descriptor. One of the 9-12byte records the first inode
The location of the table.
I'm a 0x08 here.
So the position of the first inode is in the position of block 0x8.
0x08 X 0x400 = 0x2000

So we're tracking the inode.
The location of the table 0x2000:
We already know:
The inode number of a file system's top-level directory is 2

The size of an inode is 0x80byte.

So you know that 0x2080 to 0X20DF is the top-level directory.

The first block of data block pointer of the inode is stored in the 41-44 position. As you can see from the figure above, the data for this partition (the top-level directory) exists in the 0x18 block. OK, let's go 0x18 a block to see.
Again, the size of a block here is 0x400byte.
So 0x18
X 0x400 = 0x6000
The following figure is the data at the 0x6000:

See something familiar.
That's right. As we said, catalogs are also a kind of file. What data is stored in this directory file. We can see the files as well as the next level of folders.
The data structure of the files stored under the directory is this:

Note: This diagram references from
Http://homepage.smc.edu/morgan_david/cs40/analyze-ext2.htm
(Insert a sentence: Know why EXT2/3 file system filename length can not exceed 256 characters.) Because the file structure can only use 8bit of numbers to describe the length of the file name,
28 =
256)
So we're going to locate Mydir this folder and see what's inside.
OK, according to this form, we know that the inode offset of the file/folder in the current directory is recorded in front of the filename 8bit to 5bit before the file name.
What does the offset mean? That means relative to the inode.
The relative offset of the table's starting position (here is 0x2000).
In addition, the offset is in an inode (0x80bit).
The offset of the inode that gets the Mydir folder here is 0x0c.
So the absolute position of Mydir in the partition is:
0x2000 + 0x80 X (0x0c–0x01) = 0x2580
The reason for subtracting 0x01 is that the inode is counted from the 0x00, not the 0x01.
So let's go to 0x2580 and see what's here:

You're dizzy, @_@.
Just now we talked about the structure of the inode. The data block of an inode is in the position of 40-44byte.
Here is how much.
0x26!
So let's go and find the data for Mydir this inode.
0x26 X 0x400 = 0x9800

Did you see what we just added in the Mydir directory? Ha ha.
OK, let's go and locate the name file and look at the contents of the name below.
As you can tell from the previous illustration, the inode of a file inside a directory file starts at 4byte before the filename 0x8.
Here you can draw the name of the inode in the Inode
The offset of the table is 0x0d.
OK, let's go see the Inode for the name file.
0x2000 + 0x80 X (0x0d–0x01) = 0x2600

According to the inode structure, we know from the inode of name this file that the data block for this file is in block 0x27.
Let's take a look here.
0x400 X 0x27 = 0x9c00

Ha ha. See what's going on. Isn't this the content of the name text file we just created ...
That's how Linux found the file we saw.
Something:
This experimental note does not have a lot of theories. Technology without theoretical support is fragile. From this point of view, this experimental note is not much technical content and nutrition.
Hopefully, if a buddy has read this note, it would be great if it could lead to an in-depth study of Linux.
For further research, you can refer to this page:
Http://homepage.smc.edu/morgan_david/cs40/analyze-ext2.htm
Other than that...... Always feel my posts in the CU always no one is discerning-__-| | | It's really just something ...
Acknowledgement:
Wudx with shoes, quner with shoes.