In Unix file systems directories are just special files with special directory structures that hold the child filename, filename size and inode reference number.
The actual file metadata beyond this is normally stored in the inode itself.
My question is. How does one read the actual special directory structure in its raw form instead of its interpreted form.
Yes I know you can use ls to see the files there. That's not what I am looking for.
The simple answer is that what you want to do is to read the directory file,
with a command like cat ., cat /etc, or cat mydir.
Of course, since this is “raw” data,
you’d want to use a program that’s better suited
to displaying non-ASCII data in a human-friendly way; e.g., hexdump or od.
Unfortunately, as discussed in When did directories stop being readable as files?, most versions of Unix that were released in the past two decades or so don’t allow this. So the answer to your question may be “find a version of Unix that still allows reading directories”. AIX, most versions of BSD, and all but the most recent versions of Solaris may qualify. Finding a Linux that allows it may require the use of a time machine.
The structure is entirely dependent on the specific filesystem being used, and the only way to read it is by directly reading from the disk ( i.e. /dev/sda1 ), and interpreting the filesystem yourself.
dd and a hex editor.
I know it's an old question but I was looking for information on the structure of the directory and found this.
To get the raw data inside a directory file, you can use debugfs.
For example:
sudo debugfs /dev/sda1
The you can ls, cd, and so on as usual, or cat a directory.
This isn't very readable so you can use:
dump / dumproot
This creates a file called dumproot in the location where you invoked debugfs.
To get the raw content of it you can use xxd.
For example:
xxd dumproot | head -n2
00000000: 0200 0000 0c00 0102 2e00 0000 0200 0000 ................
00000010: 0c00 0202 2e2e 0000 0b00 0000 1400 0a02 ................
This shows the . and .. entries of my / directory, both have inode number 2, that's the 02000000 at the start. With bigger inode numbers you see them at the start of an entry in little endian.
. is hex 2e, so that's visible in there as well. I'm not quite sure what "0c00 0102" represents, or how an end of an entry is specified.
That's what I was looking for when i found this thread.
A programming interface exposes the directory entry as a special type of stream, handled by functions opendir, readdir, closedir and other related functions. The file entry that you get out of it is described in the man page (it contains file inode and some other data):
http://linux.die.net/man/3/readdir
Anything more low level than that will depend on the actual implementation of the filesystem. It is completely up to the filesystem design what to use to store its directory tree. Some use B trees, some use B+ trees, some use flat tables and so on. There may even be redundant copies of inode data, checksums, encryption, extended attributes and so on.
Note that even for filesystems that are not based on inodes (FAT for instance), the kernel driver abstracts it so that the user doesn't have to care about this difference.
Nearly all informationen provided by the filesystem for an inode can be listed by the stat command. This can be seen like the raw information of the inode of files and directories.
stat FILE
a lot of information about the inodes in Linux can be found here
If you want to examine the general creation of a filesystem try the following:
As root do:
mkdir mountpoint
dd if=/dev/zero of=file_s.img bs=50k count=2
mkfs.ext2 file_s.img
cp file_s.img file_s_orig.img
mount -o loop file_s.img mountpoint
bless file_s.img
