Hello,
I hope this is the right place for my question as a learner in IT-sec.
For the Superblock analysis in ext3 partitions I found in the "File System Forensic" book that
Bytes 8–11 of the superblock contain "Number of blocks reserved to prevent file system from filling up"
But is it possible to locate these blocks? No further information is stored where I can find them.
Or is it just to calculate No more write access if there are only "number of blocks" free?
Thanks
Mi2
I am not sure to understand your question ? .
The attention is (was) for allowing Superusers to edit files safely, compare the EXT2
http//
and EXT4 documentation
https://
In EXTx that would be field "s_r_blocks_count"
http//
That area is a sort of "slack space" reserved for use "in case of need", and it's size may depend from a number of factors, see
http//
http//
for a "how to check"/"how to change" this size.
The location of these blocks is not "fixed" (and they are not "preallocated") the following set of bytes at 0xC represent "Total number of unallocated blocks" or "Free block count" (and is obviously dynamically updated when writes/deletions occur), if this is too low the f_bavail is set to 0, check
https://
which amounts - more or less - to "disk is full".
Is this what you were asking?
jaclaz
