tar issues
Hi,
I'm having an investigation of tar archives. I'm running Fed8 and I archived two files, one is 28 bytes, the other 136 bytes, the archive turns out to be 10240 bytes. This seems strange? From what I know the structure should be say a 512 byte header for the first file, then say 512 bytes of data (for 28 bytes + padding), then another 512 bytes for the second file header, then another 512 bytes of data (for 136 bytes + padding). And then I believe that there should be two blocks of zero's at 512 each. Therefore in total it should be 3072 bytes... What is this other data? When I 'cat' the archive (because both stored files are txt) it dumps as described at 3072 bytes, so i'm very bemused. NB: yes it is 'ustar' format, but other than the extra header info there shouldn't be a difference should there? Any insight please? |
Well, if the default block size on your disk is 4k (4096), which I believe is usual, then each file is 4096 bytes, so 2 files = 8192
+ (2 * 512 bytes per file hdr) +( 2 * 512 bytes of zeros as you describe...) 8192 1024 1024 + ----- 10240 |
That starts to make sense then, but why don't the header and zeros require a full block? And overall it is 2.5 blocks in size (if at 4096)!
According to tar manual the block's are written at 512 as standard in tar files, for portability (unless specifically stated). I've just (semi) manually dumped each section of the tar file (using fseek): start what ----------------------------- 0: hdr 512: file (34) 1024: hdr 1536: file (136) This dumped as expected, but what about the rest? 2048 + 1024 = 3072 in total Surely this would fit within a single 4096 block, so why 2.5? NOTE: (paranoia set's in...) # rkhunter --check This indicates no problems... ... # chkrootkit Quote:
|
It also depends on how you measure a file. Some tools measure the 'size taken by a file' (in in blocks), some measure actual data size eg 136 bytes...
From your desc, tar adds 512 bytes for padding; that's 512 actual data bytes, nothing to do with disk-block size. I haven't read the tar page. Try man du, man df for more info. |
OK, after some more tests with same results:
Total: 10240 bytes 4 blocks with content (2048 bytes) 16 blocks full of zeros (8192 bytes) I awent a looking for more info and spent a while reading the 'info' pages and then found a copy online (http://osr507doc.sco.com/cgi-bin/inf...gz)Top&lang=en), and this seems to explain best: Quote:
|
All times are GMT -5. The time now is 03:46 PM. |