The EXT3/EXT4 File Systems

Summary

Ext3 and ext4 are very similar to ext2 and the ability to analyse ext2 will allow for easier analysis of the later versions. However, both ext3 and ext4 introduced new structures which improved the file system and slightly altered the method of analysis. Ext3 introduced the journal to the ext family. The journal allows the potential for the recovery of deleted files, something that is difficult in the ext family due to the block pointers being overwritten in the inode when a file is deleted. The journal provides the possibility of recovering older versions of the inode with the block pointers intact. Ext4 introduced large inodes which improved timestamp granularity and overcame the Y2038 problem found in previous versions. Ext4 also introduced new means of data storage. Block pointers are no longer used, instead being replaced by extent‐based and inline storage depending on file size.