File-system basics


Hard drive arrangement.

Cylinder, head, sectors.

Sector - 512 bytes, newer 4096 bytes.

Originally addressed as C/H/S.

blocks and clusters
Cluster sectors together - address block rather than sector.
Cluster size same on a particular partition/drive.

partitions
Break a drive into partitions
Sectors on a partition are renumbered from zero.
Cluster size can be different on different partition.
Each partition can hold a different file-system/OS


LBA - logical block addressing

28 bit - 2^28 = 268435456 ~ 16TB but for other reasons ~ 4TB.
48 bit - 2^48 = 281474976710656 - massively huge.




Linux File-system partition.

Three parts.
Super-block - overall configuration of partition
Inode table - table for tracking available and used file storage.
File block - free and available blocks for storing file data.

Originally, once super-block and inode table created,
  their sizes fixed.

Inode table was a single structure immediately following sunblock, 
  with a backup located elsewhere on partition.

Current system divides partition up into smaller regions and create
a separate inode table for each.

Current systems reserve space in Superblock to allow additional inode
tables to be created if the current tables are full and there is still
space on partition.


Superblock. - describes overall configuration of partition.
  Contains information such as :
    File-system type.
    Features - journalling, special file-types, etc.
    Size of blocks on partition.
    Number of blocks on partition.
    Number of free blocks.
    Number of inodes on partition.
    Number of free inodes.
    Creation date.
    Last mount date.
    Grouping info. 
    Location(index) of 1st usable inode (usually root's)

* The following has to be run as an admin.
dumpe2fs -h /dev/sda7 > sb.txt

Superblock listing


Inode table.
  
Inode contents
 Device ID
 Inode ID
 File type 
 File mode - permissions.
 Link count - number of names. 
 UID - owner's ID
 GID - group ID
 Device # - for block and character, special interfaces.
 File size - bytes
 Optimal block size for I/O
 Block count - 512 byte/block. May be different, 4KiB, on newer drives.
 Time last accessed.
 Time last modified.
 Time last status change - inode info changed.
 * time recorded down to nS.
 Pointers to drive blocks holding data.

For overview of filesystem, try :

stat -f /home/hopper


Inode file pointes

Block size on Linux is usually 4K.
Maximum file size is 4GB.
Inodes are of fixed size.

So, how does Linux track file's data.
* Assume a pointer is 32 bit.

1st 10 pointers in inode point directly to file's data blocks.
  (10 pointers for total of 40 bytes in inode)

11th pointer points to a block on the hard drive (indirect)
  This block is contains a set of points to the file's data blocks.
  (4 bytes in inode and 1K pointers in drive block)

12th pointer points to a block on the hard drive (double indirect)
  This block is contains a set of points to another set of blocks on drive.
  These blocks then are set to point to file's data blocks.
  (4 bytes in inode + 1K pointer * 1K pointers) 
   Max file size (4 K block) 2^2 * 2^10 * 2^10 2^10 * = 2^32 or 4GiB

13th pointer points to a block on the hard drive (triple indirect)
  This block is contains a set of points to another set of blocks on drive.
  These, in turn, contain a set of points to another set of blocks on drive.
  These blocks then are set to point to file's data blocks.
  (4 bytes in inode + 1K pointer * 1K pointers * 1K pointer)
  1K pointer * 1K pointers * 1K pointer = 2^30 pointers 
   Max file size (4 K block) 2^2 * 2^10 * 2^10 2^10 2^10 * = 2^42 or 4TiB
    
Check out : https://digital-forensics.sans.org/blog/2008/12/24/understanding-indirect-blocks-in-unix-file-systems

quota -v
Run it on hopper to check your account quota.
Log directly into babbage and run it there to check web-page usage.

stat filename

-f - stats on filesystem of file named.
-c - list of modifiers for data available

stat -c "%a" file - file info

%a     access rights in octal
%A     access rights in human readable form
%b     number of blocks allocated (see %B)
%B     the size in bytes of each block reported by %b
%C     SELinux security context string
%d     device number in decimal
%D     device number in hex
%f     raw mode in hex
%F     file type
%g     group ID of owner
%G     group name of owner
%h     number of hard links
%i     inode number
%m     mount point
%n     file name
%N     quoted file name with dereference if symbolic link
%o     optimal I/O transfer size hint
%s     total size, in bytes
%t     major device type in hex, for character/block device special files
%u     user ID of owner
%U     user name of owner
%w     time of file birth, human-readable; - if unknown
%W     time of file birth, seconds since Epoch; 0 if unknown
%x     time of last access, human-readable
%X     time of last access, seconds since Epoch
%y     time of last data modification, human-readable
%Y     time of last data modification, seconds since Epoch
%z     time of last status change, human-readable
%Z     time of last status change, seconds since Epoch

stat -c "%a" -f file - info on filesystem of file
%a     free blocks available to non-superuser
%b     total data blocks in file system
%c     total file nodes in file system
%d     free file nodes in file system
%f     free blocks in file system
%i     file system ID in hex
%l     maximum length of filenames
%n     file name
%s     block size (for faster transfers)
%S     fundamental block size (for block counts)
%t     file system type in hex
%T     file system type in human readable form