The inode table is a stream of metadata blocks holding one inode after another, with no padding between them; each starts with the same 16-byte header, and its type says what follows. There is no index: a directory entry names an inode by a reference, and the superblock names the root. Inodes are numbered from 1; the numbers are stored in each inode and in the directory entries. All numbers are in the image’s byte order.
Common header
| Offset | Size | Type | Name | Description |
|---|---|---|---|---|
0 | 2 | uint16 | Type | 1 directory, 2 file, 3 symbolic link, 4 block device, 5 character device, 6 FIFO, 7 socket, then the extended forms: 8 directory, 9 file, 10 symbolic link, 11 block device, 12 character device, 13 FIFO, 14 socket. |
2 | 2 | uint16 | Mode | The permission bits: the low 12 bits of a Unix mode (rwxrwxrwx and setuid 04000, setgid 02000, sticky 01000). The file type is not in it; the inode’s type gives that. |
4 | 2 | uint16 | Uid index | An index into the id table: the owner is the id stored there. |
6 | 2 | uint16 | Gid index | An index into the id table: the group. |
8 | 4 | uint32 | Modification time | Seconds since 1970-01-01 (UTC). |
12 | 4 | uint32 | Inode number | 1 to the inode count, unique. The directory entries repeat it (as a difference); the export table is indexed by it. |
A hard link is a second directory entry that names the same inode. The link count is in the inode of each type that has one (nlink); a basic file inode has no link count and counts as 1, so a file with several links is written as an extended file.
Directories: types 1 and 8
Following the header of a basic directory (type 1), 16 bytes:
| Offset | Size | Type | Name | Description |
|---|---|---|---|---|
16 | 4 | uint32 | Start block | The offset of the metadata block of the directory table that holds the listing, counted from the start of that table. |
20 | 4 | uint32 | Link count | 2 plus the number of subdirectories. |
24 | 2 | uint16 | File size | The size of the listing in bytes plus 3 (the “.” and “..” entries are not stored, but counted). An empty directory has 3. |
26 | 2 | uint16 | Offset | Where the listing starts in that block, after decompression. |
28 | 4 | uint32 | Parent inode | The inode number of the parent directory (for the root, one more than the inode count). |
An extended directory (type 8) is used when the listing needs an index or the directory has extended attributes, and when the listing is too long for 16 bits. Following the header, 24 bytes:
| Offset | Size | Type | Name | Description |
|---|---|---|---|---|
16 | 4 | uint32 | Link count | As above. |
20 | 4 | uint32 | File size | The size of the listing plus 3. |
24 | 4 | uint32 | Start block | As above. |
28 | 4 | uint32 | Parent inode | As above. |
32 | 2 | uint16 | Index count | The number of index entries that follow. |
34 | 2 | uint16 | Offset | As above. |
36 | 4 | uint32 | Xattr index | An index into the xattr id table, or 0xFFFFFFFF for none. |
40 | … | index | Directory index | Index count entries, described in directories. |
Files: types 2 and 9
A basic file (type 2), 16 bytes after the header, then the block list:
| Offset | Size | Type | Name | Description |
|---|---|---|---|---|
16 | 4 | uint32 | Start block | The file offset of the first data block. The blocks of a file follow one another from there. |
20 | 4 | uint32 | Fragment | The index of the fragment block that holds the file’s tail, or 0xFFFFFFFF when the file has no tail in a fragment. |
24 | 4 | uint32 | Offset | Where the tail starts inside the decompressed fragment block (ignored when there is no fragment). |
28 | 4 | uint32 | File size | The size of the file in bytes. |
32 | 4 × n | uint32[] | Block list | One size word for each data block. With a fragment, n is the file size divided by the block size, rounded down (the tail is not in the list); without one, n is the file size divided by the block size, rounded up. |
An extended file (type 9) is used when the basic form cannot say it: files of 4 GiB or more, files with several links, and files with extended attributes. The extended form also has a field for the number of bytes that are holes. More bytes are needed before the block list:
| Offset | Size | Type | Name | Description |
|---|---|---|---|---|
16 | 8 | uint64 | Start block | As above. |
24 | 8 | uint64 | File size | As above. |
32 | 8 | uint64 | Sparse | The number of bytes of the file that are holes (sparse blocks that take no space), or 0. |
40 | 4 | uint32 | Link count | The number of directory entries that name the inode. |
44 | 4 | uint32 | Fragment | As above. |
48 | 4 | uint32 | Offset | As above. |
52 | 4 | uint32 | Xattr index | An index into the xattr id table, or 0xFFFFFFFF. |
56 | 4 × n | uint32[] | Block list | As above. |
Symbolic links: types 3 and 10
| Offset | Size | Type | Name | Description |
|---|---|---|---|---|
16 | 4 | uint32 | Link count | The number of directory entries that name the inode. |
20 | 4 | uint32 | Target size | The length of the target in bytes (at most 4096 in practice). |
24 | size | bytes | Target | The path the link points to, with no terminator. |
24 + size | 4 | uint32 | Xattr index | Type 10 only: an index into the xattr id table, or 0xFFFFFFFF. |
Devices, FIFOs and sockets: types 4, 5, 6, 7 and 11 to 14
| Offset | Size | Type | Name | Description |
|---|---|---|---|---|
16 | 4 | uint32 | Link count | All seven types. |
20 | 4 | uint32 | Device number | Block and character devices only (types 4, 5, 11, 12). Major is (n & 0xFFF00) >> 8; minor is (n & 0xFF) | ((n >> 12) & 0xFFF00), the Linux encoding of 20-bit minors. |
20 or 24 | 4 | uint32 | Xattr index | The extended forms (types 11 to 14) only: an index into the xattr id table, or 0xFFFFFFFF. |
FIFOs and sockets carry nothing but the header and the link count (and the xattr index when
extended). The device number is the number the mknod call was given; a few
hosts encode large numbers differently when they build an image, so check against the kernel’s
formula above rather than the host’s major().
Types in directory entries
A directory entry carries the basic type of the inode it names (1 to 7), also for an extended inode: an extended file is listed as type 2. A reader should check that the entry’s type and the inode’s agree, and that the entry’s inode number equals the inode’s.