Mastering Reverse Engineering
上QQ阅读APP看书,第一时间看更新

The filesystem

The filesystem is where data is stored directly to the physical disk drive. These filesystems manage how files and directories are stored in the disk. Various disk filesystems have their own variation of efficiently reading and writing data. 

There are different disk filesystems such as FAT, NTFS, ex2, ex3, XFS, and APFS. Common filesystems used by Windows are FAT32 and NTFS. Stored in the filesystem is information about the directory paths and files. It includes the filename, size of the file, date stamps, and permissions.

The following screenshot shows the information stored in the filesystem about bfsvc.exe:

In previous MacOS X versions, file information and data are stored in resource forks. Resource forks are actually deprecated but backward compatibility still exists on recent versions of MacOS. A file has two forks stored in the filesystem, the data fork and the resource fork. The data fork contains unstructured data, while the resource fork contains structured data. The resource fork contains information such as the executable machine code, icons, shape of an alert box, string used in the file, and so forth. For instance, if you wanted to back up a Mac application by simply moving it to a Windows hard drive then moving it back, the Mac application will no longer open. While transferring, only the file gets transferred but the resource fork gets stripped out in the process. Simple copy tools don't respect the forks. Instead, Mac developers developed tools to synchronize files to and from external disks.