2

In Unix file systems directories are just special files with special directory structures that hold the child filename, filename size and inode reference number.

The actual file metadata beyond this is normally stored in the inode itself.

My question is. How does one read the actual special directory structure in its raw form instead of its interpreted form.

Yes I know you can use ls to see the files there. That's not what I am looking for.

3

The simple answer is that what you want to do is to read the directory file, with a command like cat ., cat /etc, or cat mydir.  Of course, since this is “raw” data, you’d want to use a program that’s better suited to displaying non-ASCII data in a human-friendly way; e.g., hexdump or od.

Unfortunately, as discussed in When did directories stop being readable as files?, most versions of Unix that were released in the past two decades or so don’t allow this.  So the answer to your question may be “find a version of Unix that still allows reading directories”.  AIX, most versions of BSD, and all but the most recent versions of Solaris may qualify.  Finding a Linux that allows it may require the use of a time machine.

  • Most BSDs still allow it. – Andrew Jul 6 '15 at 5:57
  • A current release of OpenBSD does not allow it. – Kusalananda Jun 8 '18 at 10:16
5

The structure is entirely dependent on the specific filesystem being used, and the only way to read it is by directly reading from the disk ( i.e. /dev/sda1 ), and interpreting the filesystem yourself.

  • I take this to mean that I need to write a program that directly interacts with the filesystem? – Biff Jan 12 '15 at 3:35
  • @Biff Yes, you need to write a program that understands the on-disk data structures of the particular filesystem type in use (or uses a library that does that for you). Also, you probably don't want to run such a program while the filesystem is mounted. – Celada Jan 12 '15 at 9:17
  • @Biff, a program would help certainly, but you can always do it manually with dd and a hex editor. – psusi Jan 12 '15 at 13:44
3

A programming interface exposes the directory entry as a special type of stream, handled by functions opendir, readdir, closedir and other related functions. The file entry that you get out of it is described in the man page (it contains file inode and some other data):

http://linux.die.net/man/3/readdir

Anything more low level than that will depend on the actual implementation of the filesystem. It is completely up to the filesystem design what to use to store its directory tree. Some use B trees, some use B+ trees, some use flat tables and so on. There may even be redundant copies of inode data, checksums, encryption, extended attributes and so on.

Note that even for filesystems that are not based on inodes (FAT for instance), the kernel driver abstracts it so that the user doesn't have to care about this difference.

2

I know it's an old question but I was looking for information on the structure of the directory and found this.

To get the raw data inside a directory file, you can use debugfs. For example:

sudo debugfs /dev/sda1

The you can ls, cd, and so on as usual, or cat a directory. This isn't very readable so you can use:

dump / dumproot

This creates a file called dumproot in the location where you invoked debugfs. To get the raw content of it you can use xxd. For example:

xxd dumproot | head -n2

00000000: 0200 0000 0c00 0102 2e00 0000 0200 0000  ................
00000010: 0c00 0202 2e2e 0000 0b00 0000 1400 0a02  ................

This shows the . and .. entries of my / directory, both have inode number 2, that's the 02000000 at the start. With bigger inode numbers you see them at the start of an entry in little endian. . is hex 2e, so that's visible in there as well. I'm not quite sure what "0c00 0102" represents, or how an end of an entry is specified. That's what I was looking for when i found this thread.

  • Hi, welcome on the Unix SE! You are a good linuxer, you can type in complex expressions without a single mistake in the command line, I would suggest to do the same with the "I" if you write on English. :-) – peterh Jun 8 '18 at 10:30
0

Nearly all informationen provided by the filesystem for an inode can be listed by the stat command. This can be seen like the raw information of the inode of files and directories.

stat FILE

a lot of information about the inodes in Linux can be found here

If you want to examine the general creation of a filesystem try the following:

  • create an empty file of about 100kB
  • format file with desired filesystem
  • backup this raw file
  • mount as loop device
  • create some dirs and files
  • analyze changes with hexdiff or hexeditor of your coice

As root do:

mkdir mountpoint
dd if=/dev/zero of=file_s.img bs=50k count=2
mkfs.ext2 file_s.img
cp file_s.img file_s_orig.img
mount -o loop file_s.img  mountpoint
bless file_s.img
  • That doesn't answer the question. – psusi Jan 12 '15 at 1:25
  • Then it seems, that I am too stupid to understand his question. "special directory structure in its raw form" Does he want a file system dump? – SeDav Jan 12 '15 at 1:29
  • Yes; he said he knows the directory entry points to the inode, but he wants to see the actual directory entry rather than the contents of the inode. – psusi Jan 12 '15 at 1:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.