Reverse lookup of inode/file from offset in raw device on linux and ext3/4?
Posted
by
lilinjn
on Super User
See other posts from Super User
or by lilinjn
Published on 2012-10-21T22:06:23Z
Indexed on
2012/10/21
23:06 UTC
Read the original article
Hit count: 230
In linux, given an offset into a raw disk device, is it possible to map back to an partition + inode?
For example, suppose I know that string "xyz" is contained at byte offset 1000000 on /dev/sda: (e.g. xxd -l 100 -s 1000000 /dev/sda shows a dump that begins with "xyz")
1) How do I figure out which partition (if any) offset 1000000 is located in?(I imagine this is easy, but am including it for completeness)
2) Assuming the offset is located in a partition, how do I go about finding which inode it belongs to (or determine that it is part of free space) ? Presumably this is filesystem specific, in which case does any one know how to do this for ext4 and ext3?
© Super User or respective owner
