The relevant code is inside /etc/rc.d/rc.shutdown .
The save-file gets created by
dd if=/dev/zero of=/mnt/sdb1/save-file-name.2fs bs=1k size=512
mkfs -q -m 0 -F /mnt/sdb1/save-file-name.2fs
size=512 for 512MiB save-file .
Then the save-file has to be mounted
mount -t ext2 -o noatime,rw,loop /mnt/sdb1/save-file-name.2fs /tmp/save1stpup
cp -a /initrd/pup_rw/* /tmp/save1stpup/
This applies to ext2 filesystem , for ext3 read the rc.shutdown script .
The copy command might also not copy any hidden files .
It would need
cp -a /initrd/pup_rw/root/.[a-zA-Z0-9]* /tmp/save1stpup/root/