FFS - Re: UFS filesystems

On 01/21/2013 06:05 PM, Toby Thain wrote: Thanks - that did let me infer the directory data block format which I'd not seen described anywhere else. The three big unknowns I have at the moment are: 1) how to calculate the offset within the dump to each cylinder group header. I can find them by searching for the CG magic number (which is at offset 0x4 within each) but I don't know how their offsets are calculated, or stored in the superblock, or stored elsewhere (at least one text that I read implied that they were stored in a lookup table completely separate to the superblock) 2) how to calculate the offset from each CG header to the start of that CG's inode table. It seems to be 8192 bytes in all the UTek dumps that I have, but I don't know if it's always 8192 bytes for any UFS implementation, or even that I can assume it's always 8192 for UTek. 3) how inode data block pointers work. e.g. how the address stored in each block pointer is translated to a physical offset from the start of the partition dump. In one example that I have here, I've managed to find the data block containing the root directory, but the address which it's at seems to have no simple correlation that I can see to the data block pointer in the corresponding inode. cheers Jules