CYBER FORENSICS - LINUX FILE SYSTEM

Linux File System :-

Linux file system include the ext family ,that is ext2,ext3,ext4, and others which are more exotic  like XFS,JFS,ReiserFS,btrfs.I will be explaining the ext family here and other will be explained later("lets start from a corner !!").

1)ext2

2)ext3/ext4


1)ext2:-

The layout of ext2 is based on the UNIX filesystem.It can be simply said as partions of partion.In this the disk is divided into partition which is further divided into further subsections.The partions are divided into groups which contains a superblock,group descripter,block bitmap,inode bitmap,inode table,
data blocks ("CONFUSED!!!!").

Okay lets make it less "CONFUSING"

-->SUPERBLOCK:

     The metadata of the filesystem is stored in the superblock.

-->GROUP DESCRIPTER:

     The information about the group is stored in the group descripter.It includes   table of inodes, allocation bitmaps for the inodes and data blocks.

The below flowchart shows roughly how a ext2 looks like .





2)ext3/ext4:-

If ext2 gets added up with a process called journaling then it becomes ext3/ext4.Journaling protects the file by changing is used the read/write process on the disk into an atomic transaction.This implies that if a writing process takes place then either all the data gets written or nothing gets written.What a journaling OS does is that it first allows the file system to write to a journal before writing on to the disk which sets the transaction flag is set.Now when the data is written from the journal to the disk then the transaction flag is cleared and journal is wiped.


Hope you all got a theoretical grab on to the linux file system.
Catch you later on my next post

Comments