From owner-freebsd-hackers@FreeBSD.ORG Wed Jan 14 13:54:54 2004 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9552A16A4CE for ; Wed, 14 Jan 2004 13:54:54 -0800 (PST) Received: from smtp.des.no (flood.des.no [217.116.83.31]) by mx1.FreeBSD.org (Postfix) with ESMTP id 315C143D53 for ; Wed, 14 Jan 2004 13:54:52 -0800 (PST) (envelope-from des@des.no) Received: by smtp.des.no (Pony Express, from userid 666) id 8E728530A; Wed, 14 Jan 2004 22:54:50 +0100 (CET) Received: from dwp.des.no (des.no [80.203.228.37]) by smtp.des.no (Pony Express) with ESMTP id 78FE65309; Wed, 14 Jan 2004 22:54:41 +0100 (CET) Received: by dwp.des.no (Postfix, from userid 2602) id 07C6A33C9A; Wed, 14 Jan 2004 22:54:41 +0100 (CET) To: David Gilbert References: <16389.25821.502399.872877@canoe.dclg.ca> From: des@des.no (Dag-Erling =?iso-8859-1?q?Sm=F8rgrav?=) Date: Wed, 14 Jan 2004 22:54:40 +0100 In-Reply-To: <16389.25821.502399.872877@canoe.dclg.ca> (David Gilbert's message of "Wed, 14 Jan 2004 10:48:45 -0500") Message-ID: User-Agent: Gnus/5.090024 (Oort Gnus v0.24) Emacs/21.3 (berkeley-unix) MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable X-Spam-Checker-Version: SpamAssassin 2.61 (1.212.2.1-2003-12-09-exp) on flood.des.no X-Spam-Level: ss X-Spam-Status: No, hits=2.6 required=5.0 tests=RCVD_IN_DYNABLOCK, RCVD_IN_SORBS autolearn=no version=2.61 cc: freebsd-hackers@freebsd.org Subject: Re: Filesystem marker. X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Jan 2004 21:54:54 -0000 David Gilbert writes: > Is there a set of bytes at some offset in a block that is common to > any instance of a BSD ufs filesystem? Yes, you should find copies of the superblock for each file system at regular intervals. On a little-endian machine, each superblock will contain, at offset 0x55c, the bytes 0x54 0x19 0x01 0x00 (for UFS1) 0x19 0x01 0x54 0x19 (for UFS2) obviously on a big-endian machine they will be in the reverse order (but at the same offset) Note that you may get false positives from files containing data that happens to match the UFS magic numbers (e.g. dumps). The offset of the first superblock backup relative to the start of the filesystem depends on the newfs parameters. I believe that with default values in 5.x the superblocks will be at sector offsets 160, 376512, 752864 and so on in increments of 376352 sectors. For UFS1, the sector offsets will be 32, 376224, 752416 and so on in increments of 376192 sectors. For older UFS1 filesystems created back when newfs defaulted to 8192-byte blocks and 1024-byte fragments, the offsets will be 32, 92448, 184864 and so on in 92416-sector increments. The layout of the superblock is described in /sys/ufs/ffs/fs.h (see the definition of struct fs) DES --=20 Dag-Erling Sm=F8rgrav - des@des.no