Hi,<br><br>I'm fairly new to XFS and am preparing a report (for both my own and my team's education) on the low-level partition structure of an XFS primary superblock. This is from a computer forensic perspective.<br>
<br>I'm currently trying to determine the actual hexidecimal offset structure for all the fields within a primary superblock of an XFS partition.<br><br>For example, I know that the value for the field XFS_SB_MAGIC is 0x58465342 as this is readily available in XFS documentation, however I need to know the hex offsets, byte lengths, and method of interpretation for all of the following fields as defined within xfs_sb:<br>
<br>__uint32_t sb_magicnum; /* magic number == XFS_SB_MAGIC */<br>__uint32_t sb_blocksize; /* logical block size, bytes */<br>xfs_drfsbno_t sb_dblocks; /* number of data blocks */<br>
xfs_drfsbno_t sb_rblocks; /* number of realtime blocks */<br>xfs_drtbno_t sb_rextents; /* number of realtime extents */<br>uuid_t sb_uuid; /* file system unique id */<br>
xfs_dfsbno_t sb_logstart; /* starting block of log if internal */<br>xfs_ino_t sb_rootino; /* root inode number */<br>xfs_ino_t sb_rbmino; /* bitmap inode for realtime extents */<br>
xfs_ino_t sb_rsumino; /* summary inode for rt bitmap */<br>xfs_agblock_t sb_rextsize; /* realtime extent size, blocks */<br>xfs_agblock_t sb_agblocks; /* size of an allocation group */<br>
xfs_agnumber_t sb_agcount; /* number of allocation groups */<br>xfs_extlen_t sb_rbmblocks; /* number of rt bitmap blocks */<br>xfs_extlen_t sb_logblocks; /* number of log blocks */<br>
__uint16_t sb_versionnum; /* header version == XFS_SB_VERSION */<br>__uint16_t sb_sectsize; /* volume sector size, bytes */<br>__uint16_t sb_inodesize; /* inode size, bytes */<br>
__uint16_t sb_inopblock; /* inodes per block */<br>char sb_fname[12]; /* file system name */<br>__uint8_t sb_blocklog; /* log2 of sb_blocksize */<br>__uint8_t sb_sectlog; /* log2 of sb_sectsize */<br>
__uint8_t sb_inodelog; /* log2 of sb_inodesize */<br>__uint8_t sb_inopblog; /* log2 of sb_inopblock */<br>__uint8_t sb_agblklog; /* log2 of sb_agblocks (rounded up) */<br>
__uint8_t sb_rextslog; /* log2 of sb_rextents */<br>__uint8_t sb_inprogress; /* mkfs is in progress, don't mount */<br>__uint8_t sb_imax_pct; /* max % of fs for inode space */<br>
<br>At <a href="http://kerneldox.net/dir_73a2d815072069310dd9b6b9499ac462.html">http://kerneldox.net/dir_73a2d815072069310dd9b6b9499ac462.html</a> I was able to look through the code of the "alloc" files for further info however was not able to find a full or definitive list. I understand that it may be possible that the field values are contiguous but I still require a byte length description for each field.<br>
<br>Can someone please let me know if/where I can find documentation for this kind of very low level partition structure analysis?<br><br>Also, can you please tell me if the values are all in little or big endian? Some file systems, particularly those of mobile phones, use both little and big though I can't see a reason for the use of alternating values within XFS (but then again I'm relatively novice to this).<br>
<br>Thank you for your time.<br><br>P. McManus<br><br><br><div style="visibility: hidden; left: -5000px; position: absolute; z-index: 9999; padding: 0px; margin-left: 0px; margin-top: 0px; overflow: hidden; word-wrap: break-word; color: black; font-size: 10px; text-align: left; line-height: 130%;" id="avg_ls_inline_popup">
</div>