UFS2 Group Descriptor

The UFS2 group descriptor has the same basic concepts as the UFS1 version, but some of its fields are larger. Its location relative to the start of the cylinder group is given in the superblock, and its location does not stagger like the UFS1 group descriptor does. The UFS2 version has the fields given in Table 17.6.

Table 17.6. Data structure for the UFS2 group descriptor.

Byte Range

Description

Essential

03

Unused

No

47

Magic signature (0x090255)

No

811

Unused

No

1215

Group number

No

1619

Unused

No

2023

Number of fragments in group

No

2427

Number of directories

No

2831

Number of free blocks

No

3235

Number of free inodes

No

3639

Number of free fragments (partial blocks)

No

4043

Last block allocated

No

4447

Last fragment allocated

No

4851

Last inode allocated

No

5283

Summary of available fragments

No

8491

Unused

No

9295

Inode bitmap (byte offset)

Yes

9699

Fragment bitmap (byte offset)

Yes

100103

Next available space in descriptor (byte offset)

No

104107

Counts of available clusters (consecutive blocks) (byte offset)

No

108111

Block bitmap (byte offset)

No

112115

Number of blocks in group

No

116119

Number of inodes in group

No

120 123

Last initialized inode

No

124135

Unused

No

136143

Last written time

No

144167

Unused

No

168+

Bitmaps and so on

Yes

Notice that in both versions, the only essential information is the offsets to the inode and fragment bitmaps. The bitmaps are located after byte 168, but still inside the block allocated to the group descriptor.

Part I: Foundations

Digital Investigation Foundations

Computer Foundations

Hard Disk Data Acquisition

Part II: Volume Analysis

Volume Analysis

PC-based Partitions

Server-based Partitions

Multiple Disk Volumes

Part III: File System Analysis

File System Analysis

FAT Concepts and Analysis

FAT Data Structures

NTFS Concepts

NTFS Analysis

NTFS Data Structures

Ext2 and Ext3 Concepts and Analysis

Ext2 and Ext3 Data Structures

UFS1 and UFS2 Concepts and Analysis

UFS1 and UFS2 Data Structures

Summary

Bibliography

Bibliography



File System Forensic Analysis
File System Forensic Analysis
ISBN: 0321268172
EAN: 2147483647
Year: 2006
Pages: 184
Authors: Brian Carrier

Flylib.com © 2008-2020.
If you may any questions please contact us: flylib@qtcs.net