If I have an image of a filesystem taken with dd, I can look at it with a hex editor and discover that an ext2/3 superblock is at offset 1024 and I can figure out a lot of info about it. I cannot figure out, however, how the superblock differs from ext2 in ext3. I can't tell them apart... the "magic number" is the same as well as the "revision" field. If I have such an image file and a hex editor, how can I discover whether I'm looking at an ext2 or an ext3 filesystem? Thanks! -Jeff Meininger
Jeff Meininger wrote:> > If I have an image of a filesystem taken with dd, I can look at it with a > hex editor and discover that an ext2/3 superblock is at offset 1024 and I > can figure out a lot of info about it. I cannot figure out, however, how > the superblock differs from ext2 in ext3. I can't tell them apart... the > "magic number" is the same as well as the "revision" field. > > If I have such an image file and a hex editor, how can I discover whether > I'm looking at an ext2 or an ext3 filesystem? >000400: 00 60 00 00 A9 7F 01 00 2E 13 00 00 3B DE 00 00 >@`@@@@@@.@@@;@@@< 000410: C1 5F 00 00 01 00 00 00 00 00 00 00 00 00 00 00 >@_@@@@@@@@@@@@@@< 000420: 00 20 00 00 00 20 00 00 00 08 00 00 14 35 85 3B >@ @@@ @@@@@@@5@;< 000430: 14 35 85 3B 07 00 14 00 53 EF 01 00 01 00 00 00 >@5@;@@@@S@@@@@@@< 000440: 1A 0B 84 3B 00 4E ED 00 00 00 00 00 01 00 00 00 >@@@;@N@@@@@@@@@@< 000450: 00 00 00 00 0B 00 00 00 80 00 00 00 04 00 00 00 >@@@@@@@@@@@@@@@@< ^^^^^^^^^^^ 000460: 06 00 00 00 01 00 00 00 44 BD 0E 38 27 91 11 D5 >@@@@@@@@D@@8'@@@< 000470: 88 1F BC 09 97 58 6B DA 2F 62 6F 6F 74 00 00 00 >@@@@@Xk@/boot@@@< That word at offset 0x5c is `s_feature_compat'. The value 0x00000004 is #define EXT3_FEATURE_COMPAT_HAS_JOURNAL 0x0004 -