I'm a newbie to reverse engineering, so pardon my ignorance. I am trying to extract the complete filesystem from a Netgear router's firmware. Using
binwalk, I was able to extract the kernel and a
squashfs file system. So far so good. The issue is that the file system is incomplete. Many directories (e.g. /etc, /mnt, /var, /www) are only symbolic links to non-existent directories in /tmp, which itself is empty.
I'm guessing that (as I've seen on other routers) the contents of /tmp will be another filesystem that is created on startup and stored in RAM. Am I correct? And is there some way of determining the contents of the temporary filesystem from the firmware?