Ext3 users - Apr 2006 - Whats this for a block?

Hi,

I have got a question concerning directory entries. I have the following 
block containing exactly the filenames I had in one specified folder on 
the same file system:

http://www.sbox.tugraz.at/home/n/nobaq/ext2.dat

I really hoped that this is an directory block which could point me to 
the inode of the files.

But when I try to extract the data, I only get garbage. I'm reading the 
block this way: First 4 bytes are pointer to inode, second 4 bytes are 
length of the name and the the rest is the name itself and so on.

The first two entries should be '.' and '..', so the name
lengths should
be only 1 and 2, shouldn't they?

Do you know what's this for a data block? I'm just reading the wrong
way?

Is there a chance to reconstruct useful information from that data block?

Thank you very much in advance,

Nikolaus Hammler

Hi,

On Thu, 2006-04-27 at 19:46 +0200, Niki Hammler wrote:
> I have got a question concerning directory entries. I have the following 
> block containing exactly the filenames I had in one specified folder on 
> the same file system:
> 
> http://www.sbox.tugraz.at/home/n/nobaq/ext2.dat
> 
> I really hoped that this is an directory block which could point me to 
> the inode of the files.
Yes, it is.
> But when I try to extract the data, I only get garbage. I'm reading the
> block this way: First 4 bytes are pointer to inode, second 4 bytes are 
> length of the name and the the rest is the name itself and so on.
Not quite.  It's an ext2_dir_entry_2 struct from
linux/include/linux/ext2_fs.h :

        struct ext2_dir_entry_2 {
        	__le32	inode;			/* Inode number */
        	__le16	rec_len;		/* Directory entry length */
        	__u8	name_len;		/* Name length */
        	__u8	file_type;
        	char	name[EXT2_NAME_LEN];	/* File name */
        };
        
so yes, the first 4 bytes are the inode number; but then you've got a 2-
byte record length, which includes the 8 byte directory entry struct
plus the name length rounded up to the next 4 bytes (to keep the entries
4-byte aligned on disk); then the name length itself, and the inode
type, both of them just 1 byte long.
> The first two entries should be '.' and '..', so the name
lengths should
> be only 1 and 2, shouldn't they?
They are: looking at the "hexdump -C" of the data, I see

00000000  01 40 01 00 0c 00 01 02  2e 00 00 00 b6 c1 08 00  |. at
..............|
00000010  0c 00 02 02 2e 2e 00 00  02 40 01 00 14 00 09 01  |......... at
......|

so you've got inode number 0x00014001, then 0x000c = 12 bytes record
length, then a 1-byte name and file_type 2, EXT2_FT_DIR; then "." for
the name.  That completes the first record.  Then you have inode
0x0008c1b6, record length 12, name length 2 and file_type 2, for the
name "..".  And so on.

Cheers,
 Stephen