In ext filesystems,

  1. Is the content of a file always stored continuously? Or the file conent can be partitioned into different parts, with each part stored continuously, and all the parts stored not continuously? (The storage of the content of a file is pointed by its inode).
  2. An inode can have several direct and indirect pointers pointing to the content of a file. Are the pointers pointing to different places within the content of the file, to make the file content somehow "randomly" accessible?



No. Files are not always stored continuously; discontinuous storage actually has a name, "fragmentation" (because each separately stored portion of the file is a "fragment"). This is required, because otherwise you'd not be able to make a file larger than the largest contiguous free space. And appending to files would often fail (or, alternatively, require rewriting the entire file to move it).

The inode has fields to say "bytes 0 through 1048575 start at block 10,000", "bytes 1048576 through 2097152 start at block 300", etc. An inode is a fixed size, so there is a limit to the number of fragments that can be stored in the inode. When more fragments are required, the inode stores a pointer to a different block; the fragments are stored there.

If the fragment is directly pointed to by the inode, that's a direct pointer.
If the fragment is stored outside the inode, that's an indirect pointer.

A digital forensics article at SANS has a nice picture explaining. So does the Wikipedia article. Note that ext4's extents work differently; again an article at SANS.


Most linux/unix formats (ext2/ext3/ext4 and HFS/HFS+, btrfs and ZFS) try to keep data unfragmented, but there will always be some small amount of fragmentation. Usually, all but a small amount of data will be contiguous.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.