Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In linux, given an offset into a raw disk device, is it possible to map back to an partition + inode?

For example, suppose I know that string "xyz" is contained at byte offset 1000000 on /dev/sda: (e.g. xxd -l 100 -s 1000000 /dev/sda shows a dump that begins with "xyz")

1) How do I figure out which partition (if any) offset 1000000 is located in?(I imagine this is easy, but am including it for completeness)

2) Assuming the offset is located in a partition, how do I go about finding which inode it belongs to (or determine that it is part of free space) ? Presumably this is filesystem specific, in which case does any one know how to do this for ext4 and ext3?

share|improve this question
1  
It is definitely possible and a few years ago I saw the HOWTO somewhere in the internet. The trick involves some math on different parameters of the filesystem and partition table. Try to search for it. This could be useful: unix.stackexchange.com/questions/37119/… –  Serge Oct 21 '12 at 22:13

1 Answer 1

up vote 1 down vote accepted

I just had to do a similar thing, so I thought I'd share my solution.

You can see which partition a drive byte offset belongs to by checking the 'offset' and 'size' elements of the udisks --show-info output; e.g.

user@host:~$ sudo udisks --show-info /dev/sda1 | grep -i 'offset'
    offset:                    1048576
    alignment offset:          0

Subtract this offset from the disk offset to get the byte offset into the partition. So disk offset (10000000) in /dev/sda is partition offset (10000000 - 1048576) = 8951424 in /dev/sda1

You can find out how large blocks are in a partition using the following command:

user@host:~$ sudo tune2fs -l /dev/sda1  | grep -i 'block size'
Block size:               4096

Divide the partition byte offset by the block size to determine the block offset, in this case 8951424 / 4096 = 2185

Run the following command to find out what inode occupies that block:

user@host:~$ sudo debugfs -R "icheck 2185" /dev/sda1
debugfs 1.41.11 (14-Mar-2010)
Block   Inode number
2185    123456 

then the following command to find out what the filename is for that inode:

user@host:~$ sudo debugfs -R "ncheck 123456" /dev/sda1
debugfs 1.41.11 (14-Mar-2010)
Inode   Pathname
123456  /tmp/some-filename.txt

There's a longer description of how this at http://www.randomnoun.com/wp/2013/09/12/determining-the-file-at-a-specific-vmdk-offset

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.