Linux Extended File System

The extended file system, ext was created in April 1992 specifically as the first file system for use by the Linux kernel. The metadata structures are very similar to the traditional Unix File System (UFS) allowing a data volume up to 2GB in size.

In January 1993 this was replaced by the second incarnation of the file system, ext2. Depending upon the implementation in the Linux kernel, the maximum volume size can be from 2TB up to 32TB. The largest filesize is correspondingly between 16GB up to 2TB. Despite the introduction of ext3 and ext4 versions, ext2 is still being used, although mostly on SD cards and USB flash drives. Information about all versions of the file system is readily available, via the open source community, and data recovery from most situations is possible.

Features of Linux Extended File System

Ext3 introduced journaling in 1991, to allow the automatic recovery of the file and directory metadata after a crash or power failure. Like UFS the allocation is block based, with indirect allocation blocks used for large files. A driver allowing data compression is available, but in practice rarely ever used.

Ext4 was developed in 2008, which extended the maximum volume size to 1EB and the maximum file size to 16TB. The date time which can be specified was also enhanced allowing a much wider date range, as well as nanosecond resolution, rather than 1 second resolution.

Linux Extended File System Internals

The internal structure is very similar to UFS, with inodes and usage bitmaps allocated in fixed positions for each cylinder group. Ext3 saw HTree indexing added for large directories, to improve the performance of the file system, when a large number of files or directories are stored together.

Extents were added with Ext4, allowing a set of contiguous blocks to be defined efficiently, in chunks of up to 128MB. Up to four extents can be defined in the inode, with an HTree used to store the remaining allocation. The number of subdirectories allowed was also increased from 32,000 to an unlimited number.

Linux Extended File System Data Recovery

As with UFS, data recovery from ext2, ext3 and ext4 file systems is a relatively well known process, with no surprises. These file systems also suffer the same problem that the loss of directory index information, will lose the name of the file or directory associated with an inode. A reformat will also see all inodes overwritten, resulting in the loss all metadata. A data trawl in such a situation is the only data recovery option left.

If the extended file system can’t be automatically repaired and mounted by the operating system, it is important not to run third party tools in an attempt to fix the issue, as they may destroy important data structures. Once the operating system is unable to mount the file system, severe damage has occurred, which requires a professional data recovery service to examine the data, as a full understanding of the underlying data structures is necessary.

Comments are closed