Cylinder Group Summary

Both UFS1 and UFS2 have one or more fragments that contain the cylinder group summary data structures. These data structures are the same in both versions of UFS, and they contain statistical information about each cylinder group. They are organized as a table, and each entry in the table corresponds to a cylinder group. The address and size of the area are given in the superblock. Each table entry has the fields given in Table 17.4.

Table 17.4. Data structure for cylinder group summary area entries.

Byte Range

Description

Essential

03

Number of directories

No

47

Number of free blocks (full set of fragments)

No

811

Number of free inodes

No

1215

Number of free fragments (partial blocks)

No

As we will see in the next section, these data also can be found in each of the cylinder group descriptors. This information is used when allocating new inodes and blocks.

In our example UFS1 file system image, we saw that the cylinder group summary area was in block 272 and that it was allocated 1,024 bytes. The contents of that fragment are shown here:


# dcat -f openbsd openbsd.dd 272 | xxd

0000000: 0200 0000 2f03 0000 7807 0000 0b00 0000 ..../...x.......

0000016: 0200 0000 cf00 0000 6d07 0000 0500 0000 ........m.......

[REMOVED]

The table entry for group 0 is the first line, and we can see that it has two directories and 815 (0x032f) free blocks. Bytes 8 to 11 show that it has 1,912 (0x0778) free inodes, and bytes 12 to 15 show it has 11 (0x0b) free fragments in partial blocks. The second row is for the second group.

The fsstat tool in TSK will show the cylinder group information when run on a UFS image. The "File System Category" section of Chapter 16 has the fsstat output for our example image. The output contains the cylinder group information from the superblock, from the cylinder group summary area, and from the group descriptors.

Part I: Foundations

Digital Investigation Foundations

Computer Foundations

Hard Disk Data Acquisition

Part II: Volume Analysis

Volume Analysis

PC-based Partitions

Server-based Partitions

Multiple Disk Volumes

Part III: File System Analysis

File System Analysis

FAT Concepts and Analysis

FAT Data Structures

NTFS Concepts

NTFS Analysis

NTFS Data Structures

Ext2 and Ext3 Concepts and Analysis

Ext2 and Ext3 Data Structures

UFS1 and UFS2 Concepts and Analysis

UFS1 and UFS2 Data Structures

Summary

Bibliography

Bibliography



File System Forensic Analysis
File System Forensic Analysis
ISBN: 0321268172
EAN: 2147483647
Year: 2006
Pages: 184
Authors: Brian Carrier

Flylib.com © 2008-2020.
If you may any questions please contact us: flylib@qtcs.net