UFS Inode Direct Blocks

[Scott Long]

Eric Sheridan wrote:

> Hello Everyone:
> 
> My name is Eric and I am working on a project which traverses the inodes of
> the disk in order to map out the file system. I am able to read in the
> superblock with the SBLOCK_UFS2 offset. I am able to read in any disk inode
> using the following offsets:
> 
> ib = fsbtodb(superblock, itod(superblock, i_num));
> lseek(fd, ib*DEV_BSIZE, SEEK_SET);
> read(fd, buffer, sizeof(buffer));
> d = (struct ufs2_dinode *)buffer + itoo(superblock, i_num);
> 
> *Note* I have defines for the itoo and itod to appropriate ino_to_*'s
> 
> However, given the dinode, I do not know how to seek to the direct blocks of
> the dinode. My question is how do I seek to these direct blocks stored in
> di_db[] using all of these available macros? What is stored in these data
> blocks? If the inode represents a directory, then do the data blocks contain
> "struct ufs2_direct"s? If I am able to get file names from directory inodes,
> then I will be able to map out every file on the system. This is my first
> post, so I appologize for being either too vague or too verbose. Thank you
> everyone in advance for your help.
> 
> -Eric Sheridan

I'd highly recommend picking up a copy of 'The Design and Implementation 
of the FreeBSD 5.2 Operating System' by McKusick and Neville-Neil. 
Amoung other things, it contains about 50 high-quality pages on the 
design and operation of the UFS/FFS filesystem.  But, to answer your
specific questions:

The direct block pointers in the inode contain block numbers that hold
data.  Reading these block numbers from the disk will return file data.
The indirect block pointer points to a block on the disk which contains
block pointers for data.  You read this block, then you read each block
pointed to inside of it to get data.  The double indirect block pointer
points to a block that contains a bunch of indirect blocks that contain
pointers to data.  The triple indirect block pointer .....
I don't recall what macros or subroutines can be used to simplify this,
but you might want to look at the sources for libufs and fsck for hints.

For directory data blocks, yes they contain an array of ufs2_dirent 
structures.  Be aware when it comes to mapping out the filenames that
multiple dirent structures might point to the same inode.  This is a
feature of the filesystem and is how hard-links work.

Scott