Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In linux, given an offset into a raw disk device, is it possible to map back to an partition + inode?

For example, suppose I know that string "xyz" is contained at byte offset 1000000 on /dev/sda: (e.g. xxd -l 100 -s 1000000 /dev/sda shows a dump that begins with "xyz")

1) How do I figure out which partition (if any) offset 1000000 is located in?(I imagine this is easy, but am including it for completeness)

2) Assuming the offset is located in a partition, how do I go about finding which inode it belongs to (or determine that it is part of free space) ? Presumably this is filesystem specific, in which case does any one know how to do this for ext4 and ext3?

share|improve this question
1  
It is definitely possible and a few years ago I saw the HOWTO somewhere in the internet. The trick involves some math on different parameters of the filesystem and partition table. Try to search for it. This could be useful: unix.stackexchange.com/questions/37119/… – Serge Oct 21 '12 at 22:13
up vote 4 down vote accepted

I just had to do a similar thing, so I thought I'd share my solution.

You can see which partition a drive byte offset belongs to by checking the 'offset' and 'size' elements of the udisks --show-info output; e.g.

user@host:~$ sudo udisks --show-info /dev/sda1 | grep -i 'offset'
    offset:                    1048576
    alignment offset:          0

Subtract this offset from the disk offset to get the byte offset into the partition. So disk offset (10000000) in /dev/sda is partition offset (10000000 - 1048576) = 8951424 in /dev/sda1

You can find out how large blocks are in a partition using the following command:

user@host:~$ sudo tune2fs -l /dev/sda1  | grep -i 'block size'
Block size:               4096

Divide the partition byte offset by the block size to determine the block offset, in this case 8951424 / 4096 = 2185

Run the following command to find out what inode occupies that block:

user@host:~$ sudo debugfs -R "icheck 2185" /dev/sda1
debugfs 1.41.11 (14-Mar-2010)
Block   Inode number
2185    123456 

then the following command to find out what the filename is for that inode:

user@host:~$ sudo debugfs -R "ncheck 123456" /dev/sda1
debugfs 1.41.11 (14-Mar-2010)
Inode   Pathname
123456  /tmp/some-filename.txt

There's a longer description of how this at http://www.randomnoun.com/wp/2013/09/12/determining-the-file-at-a-specific-vmdk-offset

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .