Symbolic Link

Symbolic links are special files that point to another file or directory. The "content" of the file is the target of the link. Therefore, they do not require any new data structures. If the path of the destination file or directory is less than 60 characters long, it is stored in the 60 bytes in the inode that are used for the 12 direct and 3 indirect block pointers. If the path is longer than 60 characters, a block is allocated, and the block contains the destination path. The file size corresponds to the path length of the destination.

We can see an example with icat. icat shows the contents of a file, and it shows the full path because it does not process it as a symbolic link. It processes it as a normal file.

# fls -f linux-ext3 ext3-3.dd


l/l 26: file1.txt

# icat -f linux-ext3 ext3-3.dd 26



The size reported in the inode is 90, and we see in the fls output that it has the type of 'l,' which is for link.

Part I: Foundations

Digital Investigation Foundations

Computer Foundations

Hard Disk Data Acquisition

Part II: Volume Analysis

Volume Analysis

PC-based Partitions

Server-based Partitions

Multiple Disk Volumes

Part III: File System Analysis

File System Analysis

FAT Concepts and Analysis

FAT Data Structures

NTFS Concepts

NTFS Analysis

NTFS Data Structures

Ext2 and Ext3 Concepts and Analysis

Ext2 and Ext3 Data Structures

UFS1 and UFS2 Concepts and Analysis

UFS1 and UFS2 Data Structures




File System Forensic Analysis
File System Forensic Analysis
ISBN: 0321268172
EAN: 2147483647
Year: 2006
Pages: 184
Authors: Brian Carrier © 2008-2020.
If you may any questions please contact us: