Preliminary File System

Assuming one is familiar with the linux booting process (else click here). This post is simply to note down the method to view the prelimnary file system (initrd) that is used during the booting process. Don’t get confused by the fact that the name of the image is initrd. There are two types of preliminary file systems, initrd (that was used earlier) and initramfs (now used but name left the same). If the image you have in the /boot/ folder is of the type cpio archive, then it is initramfs type.

Using the command line cpio -i tool does not extracts a single folder named kernel, which contains a hierarchy of folders basically containing the bin file for the kernel and nothing else, certainly no file system. Most blogs online say that the initrd image is of compressed by gzip and then cpio or vice-versa. But this wasn’t the case with Kali 4.0.0 or ubuntu 14.

Binwalk is a command line tool that is used to analyse firmware. It basically analyses the file, looking for embedded files and executable code. Binwalk even has an option to extract the files it finds. (binwalk -E). On using this command on the initrd file, two folders are extracted, the first one, the same kernel folder and another folder that cpio does not extract. Inside the second folder, there exists another cpio archive typically named with a number (was 1000 on kali and 3600 (may not be exact number) on ubuntu. On extracting this archive, the preliminary file system is visible.

Screenshot from 2016-02-05 20_35_52


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s