11

I'm working on a midrange NAS system basically running on Linux and I got to do some great testing today. The step-by-step lead me to using fsdb to corrupt the magic number on a file system in order to corrupt it / test the script that should fix it.

I googled around quite a bit and didn't find a solid explanation. Can any shed some light in an intermediate fashion?

1 Answer 1

20

A magic number is a sequence of bytes that is used in all files of a certain format, usually at a given position (often at the beginning). Since all files in that particular format have that particular byte sequence in that particular position, and most files in other formats don't have it, the magic number is a way to recognize what format a file is in.

Here, this concept is applied to a filesystem format. For example, an ext2/ext3/ext4 filesystem always has the bytes 0x53 0xEF at positions 1080–1081. A reiserfs filesystem always has ReIsErFs starting at position 65588 (or ReIsEr2Fs, etc., in more recent versions). Other filesystems have similar magic numbers. Filesystem tools check for the presence of the magic number (and possibly other clues) to ensure that you haven't accidentally launched them on data that's organized in a format they can't deal with and could damage. If you change the magic number on a filesystem, ordinary tools are likely to refuse to touch it; repair tools might be more clever and treat a bad magic number as just one of the things that could be broken.

The file command recognizes files based on their magic numbers. You can run file -s /dev/sda1 to see what it thinks is on the partition /dev/sda1. Its decisions are based on a database typically found in /etc/magic or /usr/share/misc/magic. Specific commands may use different magic numbers to recognize the file formats they can cope with.

5
  • On Ubuntu, apt-get install source file will pull file-x.yy/magic/Magdir/filesystems which contained exactly the information the question (and I) was looking for. Jun 12, 2013 at 0:58
  • Shouldn't that be file /dev/sda1?
    – Bobby
    Sep 27, 2013 at 10:46
  • @Bobby No, file /dev/sda1 will only tell you that this is a device node, it doesn't say anything about the content. You need either file </dev/sda1 or file -s /dev/sda1. Sep 27, 2013 at 11:04
  • Oh okay, for me file < /dev/sda1 fails with the help-text from file (missing parameter?), but -s works great. Thanks.
    – Bobby
    Sep 27, 2013 at 11:06
  • 1
    @Bobby Ah, I see, I forgot one character. It's file - </dev/sda1, because you have to tell file explicitly to read from stdin. Thanks, I'll fix it. Sep 27, 2013 at 11:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .