2

Is there any Flag or some byte in SuperBlock from which I can distinguish if it is an ext4 or ext3 File System? I have already googled it and found some internal structures of ext3 & ext4, but can't find my answer.

History of ext2, ext3, and ext4
SANS Digital Forensics and Incident Response Blog

  • Is there a specific reason why you limit yourself to a flag in the superblock? There are tools that identify the file system type, can you just use one of them or do you need to do it manually by looking at bytes? – Byte Commander Sep 16 '16 at 13:01
  • ext2 3 and 4 are the same filesystem. It is the OPTIONS that make the difference so yes you can use superblock to find the options but an ext4 filesystem with journaling set to off will be indentified as ext2 (and that is for any utility you use). – Rinzwind Sep 16 '16 at 13:03
  • @Rinzwind Would you mind proof-reading my answer below? – Byte Commander Sep 16 '16 at 14:42
4

First, let's create two small disk image files my-ext3 and my-ext4 and format them in ext3 and ext4 respectively, so that we can test and see the differences:

truncate -s 10M my-ext3
mkfs.ext3 my-ext3

truncate -s 10M my-ext4
mkfs.ext4 my-ext4

Now the easiest way to check what they are is the file command:

$ file my-ext*
my-ext3: Linux rev 1.0 ext3 filesystem data, UUID=7ba99eb3-57c0-4d81-a2e7-529fdee64cbb (large files)
my-ext4: Linux rev 1.0 ext4 filesystem data, UUID=2308e0f8-443e-4164-b5ee-4810e9def008 (extents) (large files) (huge files)

As you can see, it correctly identifies each file system type. You can also examine the file systems with fsck, by mounting them or using some partitioning tools.

However, as @Rinzwind pointed out in his comment, all ext2, ext3 and ext4 file systems are basically the same, except that the higher revisions support more file system features. Those do not directly tell you whether it is ext3 or ext4, but you can check since which file system version each feature is available. If you find any ext4-only features, it must be ext4. Let's have a look at them.

The command to examine the file system is dumpe2fs. We are only interested in the superblock data, so we add the -h option, otherwise it will flood the console with tons of inode information as well. For us, only their "Filesystem features" are interesting, so let's use grep to filter that out:

$ dumpe2fs -h my-ext3 |& grep "^Filesystem features:"
Filesystem features:      has_journal ext_attr resize_inode dir_index filetype sparse_super large_file

$ dumpe2fs -h my-ext4 |& grep "^Filesystem features:"
Filesystem features:      has_journal ext_attr resize_inode dir_index filetype extent flex_bg sparse_super large_file huge_file uninit_bg dir_nlink extra_isize

Now we have two lists of file system features and can check each of them to find out which is the lowest ext? file system revision that supports each feature. We can have a look at man ext4 for that, it contains a list with all ext4 file system features, their description and since when they are supported.

I made a little list for you and ordered the features by the first ext? revision that supports them. All features from older revisions are supported in newer revisions as well:

  • ext2: ext_attr, filetype, sparse_super
  • ext3: dir_index, has_journal
  • ext4: 64bit, bigalloc, dir_nlink, extent, extra_isize, flex_bg, huge_file, meta_bg, mmp, uninit_bg

There are more features described in man ext4, but without information about which file system revisions support them: journal_dev, large_file, sparse_super2, quota, resize_inode
Probably they are all present since ext2, but I'm not 100% sure. Please leave a comment if you know more about hem.

| improve this answer | |
  • Looks good to me (but I do not claim to be an expert on filesystem ;-) ) – Rinzwind Sep 16 '16 at 14:56
  • @Byte Commander, thanks for your well explained answer, but still i have a little confusion. As I am working on a college project in C++ to identify the filesystem version like ext3 or ext4. In my module if we have a disk with 3-4 different linux volumes. I want to load the superblock structure , need to identify from that (In RAW mode) then to pass the info to next module that how we need to read data from Inode (like need to process data pointers in extents(ext4) or in direct pointer(ext2/3) . As per my understanding i must get info from superblock only to read the file system data. – CLIX159 Sep 22 '16 at 13:32
  • Maybe you should look into the source code of dumpe2fs, that's the tool I use above to examine the file system superblock. I can't tell you how it works behind the curtain and what raw binary structures you have in the superblock, but there you should be able to find it out. – Byte Commander Sep 22 '16 at 13:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.