Early userspace

From ForensicsWiki
Revision as of 09:17, 1 May 2014 by .FUF (Talk | contribs)

Jump to: navigation, search

According to Linux documentation, "early userspace" is a set of libraries and programs that provide various pieces of functionality that are important enough to be available while a Linux kernel is coming up, but that don't need to be run inside the kernel itself.

Early userspace is commonly used in various Linux Live CDs and Live USBs for loading necessary device and file system drivers, as well as for other preparatory actions (e.g. setting up framebuffer).

Early userspace is also responsible for mounting root file system, which contains a live system (desktop environment and various applications reside in a live system, while early userspace contains only a limited set of programs required for booting up).

Due to varied conditions in which Live CDs and Live USBs are booting up (for example, it is possible to make Live USB from Live CD by writing ISO 9660 image directly to USB device as well as by exporting files from ISO 9660 image to an existing file system on USB device and setting up a bootloader on this device), early userspace is responsible for locating and mounting root file system. Root file system can be represented by SquashFS image file, raw image file, partition with a file system, device without partition table (but with a file system), or even by a set of directories (although specific implementations of early userspace may not support everything listed above).

After booting, contents of root file system are visible as contents of "/" directory.