CSCI 373 System Administration — Finding a file II

Picking up

It is assume that you have follow part I and that you have the following files in your directory.

You will also need to know the following parameters discovered in part I.

Either use the dd command to copy the first Megabyte of the disk image of your root file system. Take a look at a recent copy of the dd manual page because there has been some changes to how byte size is specified.

This is going to be weird because most files in this directory do have long names. On page 24 of the Microsoft document, you will find the directory entry structure, but on page 26 you find the long directory entry structure.

Type the following command to look at the directory entires. The first should contain the spread out filename boot. You should find a directory entry every 32 bytes, but remember that most of them are long entries. 

…$ od -t a boot.rootdir.img | more

It will start with something like the following. 

0000000   b   o   o   t  sp  sp  sp  sp  sp  sp  sp  bs nul nul   C   E
0000020   r   H   r   H nul nul   C   E   r   H nul nul nul nul nul nul
0000040   A   o nul   v nul   e nul   r nul   l nul  si nul   G   a nul
0000060   y nul   s nul nul nul del del del del nul nul del del del del
0000100   O   V   E   R   L   A   Y   S  sp  sp  sp dle nul nul   7 can
0000120   S   J   S   J nul nul   7 can   S   J  gs nul nul nul nul nul
0000140   e   t nul   m nul   p nul nul nul del del  si nul can del del
0000160 del del del del del del del del del del nul nul del del del del
0000200   e   . nul   d nul   p nul   k nul   g nul  si nul can   - nul
0000220   d nul   i nul   v nul   e nul   r nul nul nul   t nul   . nul

A new directory entry starts every 32 bytes. (That’s every four lines.) However, files with long names have one entry for the short name and one or more for the long name. In the above example, the first two lines is short entry for the name of the volume, boot. The next two lines is a long entry for the long name overlays. Read every other byte to find overlays. By the way, overlays is long, because it contains lower-case letters. And then the third set of two lines is the short entry for overlays, spelled in all capitals as its abbreviated name.

The eleventh (numbered from zero) byte of a directory entry is special. Use the following command to take a look that this byte. 

…$ od -t x1 boot.rootdir.img | more

Your output should look something like the following: 

0000000 62 6f 6f 74 20 20 20 20 20 20 20 08 00 00 c3 45
0000020 72 48 72 48 00 00 c3 45 72 48 00 00 00 00 00 00
0000040 41 6f 00 76 00 65 00 72 00 6c 00 0f 00 47 61 00
0000060 79 00 73 00 00 00 ff ff ff ff 00 00 ff ff ff ff
0000100 4f 56 45 52 4c 41 59 53 20 20 20 10 00 00 37 98
0000120 53 4a 53 4a 00 00 37 98 53 4a 1d 00 00 00 00 00
0000140 e5 74 00 6d 00 70 00 00 00 ff ff 0f 00 18 ff ff
0000160 ff ff ff ff ff ff ff ff ff ff 00 00 ff ff ff ff
0000200 e5 2e 00 64 00 70 00 6b 00 67 00 0f 00 18 2d 00
0000220 64 00 69 00 76 00 65 00 72 00 00 00 74 00 2e 00

Search for the eleventh byte. You should find some of the following: 08 for a volume label, 0f for a long file name, 10 for a directory, and 20 for an unarchived file.

The /boot directory of your Pi should contain the files issue.txt and COPYING.linux. Use the following command to search for the (short) directory entries for these three. Don’t whine about having to do a sequential search. That’s also what the operating system does. 

…$od -A d -t a boot.rootdir.img | more

Once you have found offset of the appropriate 32-byte directory entries, copy them using a command similar to the following: 

…$dd if=boot.rootdir.img of=filename.direntry.txt bs=1 skip=offset count=32

For example, since the offset for issue.txt is byte 672, you can copy it with the following command. 

…$dd if=boot.rootdir.img of=issue.txt.direntry.txt bs=1 skip=672 count=32

This should be give you three directory entry files:

Now determine the starting cluster and file size of each file. Here is what worked for me for issue.txt . 

…$od -A d -j 26 -N 2 -t d2 issue.txt.direntry.txt
…$od -A d -j 28 -N 4 -t d4 issue.txt.direntry.txt

To be continued.....