when u execute "mkfs", based on your "-t" filesystem passed in to mkfs, one of the following command line utility will be executed:<div><br></div><div><div>mkfs.cramfs mkfs.ext4 mkfs.minix mkfs.reiserfs</div>
<div>mkfs.bfs mkfs.ext2 mkfs.ext4dev mkfs.msdos mkfs.vfat</div><div>mkfs.btrfs mkfs.ext3 mkfs.jfs mkfs.ntfs mkfs.xfs</div><div><br></div><div>and for each of the above command line there is a fs utility that include it. Look into the source for good understanding. For ext2/ext3 fs, it is called e2fsprogs. So in Ubuntu (or Debian-based distro) u do a "apt-get source e2fsprogs" to get the source:</div>
<div><br></div><div>reading the source of mkfs's main() function:</div><div><br></div><div><a href="http://pastebin.com/xcsB6GUC">http://pastebin.com/xcsB6GUC</a></div><div><br></div><div>u can see that after lots of code on setting structures in memory, it start by writing the inode table etc:</div>
<div><br></div><div><div><span class="Apple-tab-span" style="white-space:pre"> </span>write_inode_tables(fs, lazy_itable_init, itable_zeroed);</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>create_root_dir(fs);</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>create_lost_and_found(fs);</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>reserve_inodes(fs);</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>create_bad_block_inode(fs, bb_list);</div>
</div><div><br></div><div>Following through the source code is much more understandable than going through output of "strace", which records all the interface with the kernel.</div><div><br></div><div>Follow through the following slide:</div>
<div><br></div><div><a href="http://www.geego.com/free-linux-lpic-training-material-study-guide/lpic1-modules/4-5/ext2-ext3.html">http://www.geego.com/free-linux-lpic-training-material-study-guide/lpic1-modules/4-5/ext2-ext3.html</a></div>
<div><br></div><div><div>and forward a few slides and u will understand that mkfs is just making the header structures on the harddisk to contain the definition of the FS :</div></div><div><br></div><div>Similarly u can find many university courses on filesystem internal, eg:</div>
<div><br></div><div><a href="http://scx010c06a.blogspot.sg/2012/03/second-extended-file-system-ext2.html">http://scx010c06a.blogspot.sg/2012/03/second-extended-file-system-ext2.html</a></div><div><br></div><div>Generally, real-life analysis of the harddisk/filesystem is done in forensic, so if u googling for fs forensics u can find lots of tools that walk the harddisk for the different components:</div>
<div><br></div><div><a href="http://www.dfrws.org/2007/proceedings/p55-barik.pdf">http://www.dfrws.org/2007/proceedings/p55-barik.pdf</a></div><div><br></div><div><a href="http://www.cs.kau.se/~stefan/forensics/chapter14-15.pdf">http://www.cs.kau.se/~stefan/forensics/chapter14-15.pdf</a></div>
<div><br></div><div><a href="http://www.blackhat.com/presentations/bh-asia-03/bh-asia-03-grugq/bh-asia-03-grugq.pdf">http://www.blackhat.com/presentations/bh-asia-03/bh-asia-03-grugq/bh-asia-03-grugq.pdf</a></div><div><br>
</div><div><a href="http://www.dfrws.org/2007/proceedings/p55-barik_pres.pdf">http://www.dfrws.org/2007/proceedings/p55-barik_pres.pdf</a></div><div><br></div><div>and this is forensics of ext4 filesystem:</div><div><br></div>
<div><a href="http://www.dfrws.org/2012/proceedings/DFRWS2012-13.pdf">http://www.dfrws.org/2012/proceedings/DFRWS2012-13.pdf</a></div><div><br></div><div>Understanding "mkfs", is really as good as understanding FS internals.</div>
<div><br></div><div>On Fri, Jan 4, 2013 at 11:12 PM, KASHISH BHATIA <span dir="ltr"><<a href="mailto:kashish.bhatia1989@gmail.com" target="_blank">kashish.bhatia1989@gmail.com</a>></span> wrote:</div><div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br><br>I want to trace the overall flow of mkfs inside linux kernel. Specifically want to know which<br>kernel fs data structures are affected when we run "mkfs" ?<br>
What all "mkfs" command writes on the block device when we run the command? <br>
Are there any good documents which can explain the same?<span class="HOEnZb"><font color="#888888"><br><br>-- <br><br>Regards,<div style="color:rgb(153,153,153)">Kashish Bhatia </div>
</font></span><br>_______________________________________________<br>
Kernelnewbies mailing list<br>
<a href="mailto:Kernelnewbies@kernelnewbies.org">Kernelnewbies@kernelnewbies.org</a><br>
<a href="http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies" target="_blank">http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br>Regards,<br>Peter Teoh
</div>