[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: how to tell ext2 from ext3 at byte-level?



Jeff Meininger wrote:
> 
> If I have an image of a filesystem taken with dd, I can look at it with a
> hex editor and discover that an ext2/3 superblock is at offset 1024 and I
> can figure out a lot of info about it.  I cannot figure out, however, how
> the superblock differs from ext2 in ext3.  I can't tell them apart... the
> "magic number" is the same as well as the "revision" field.
> 
> If I have such an image file and a hex editor, how can I discover whether
> I'm looking at an ext2 or an ext3 filesystem?
> 

000400: 00 60 00 00 A9 7F 01 00 2E 13 00 00 3B DE 00 00      >@`@@@@@@.@@@;@@@<
000410: C1 5F 00 00 01 00 00 00 00 00 00 00 00 00 00 00      >@_@@@@@@@@@@@@@@<
000420: 00 20 00 00 00 20 00 00 00 08 00 00 14 35 85 3B      >@ @@@ @@@@@@@5@;<
000430: 14 35 85 3B 07 00 14 00 53 EF 01 00 01 00 00 00      >@5@;@@@@S@@@@@@@<
000440: 1A 0B 84 3B 00 4E ED 00 00 00 00 00 01 00 00 00      >@@@;@N@@@@@@@@@@<
000450: 00 00 00 00 0B 00 00 00 80 00 00 00 04 00 00 00      >@@@@@@@@@@@@@@@@<
                                            ^^^^^^^^^^^
000460: 06 00 00 00 01 00 00 00 44 BD 0E 38 27 91 11 D5      >@@@@@@@@D@@8'@@@<
000470: 88 1F BC 09 97 58 6B DA 2F 62 6F 6F 74 00 00 00      >@@@@@Xk@/boot@@@<

That word at offset 0x5c is `s_feature_compat'.  The
value 0x00000004 is

	#define EXT3_FEATURE_COMPAT_HAS_JOURNAL         0x0004

-





[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]