1

I am trying to build a partition utility, but am not really sure how to get started.

The end goal is to have a picture of the drive like the old windows disk defragger, so you can see what's data, what's empty etc, but also be able to inspect a particular location in the image and find out what file (or what part of a file) is written there.

There's probably some command line utilities that are helpful, e.g. od. However, I'm not sure how to recover the filename at a particular location...

1

You can use debugfs to view and modify ext2/ext3/ext4 file systems on a very low level.

It has an interactive shell inside which you can run its commands manually (start it using sudo debugfs /dev/sdXY, where /dev/sdXY is the device your partition is saved on), but you can also let it run single commands only by specifying them with the -R parameter.

For example, to list the blocks that are allocated for the file /bin/ls on the partition /dev/sda2, try this:

$ sudo debugfs -R 'blocks /bin/ls' /dev/sda2
debugfs 1.43.4 (31-Jan-2017)
2922912 2922913 2922914 2922915 2922916 2922917 2922918 2922919 2922920 2922921 2922922 2922923 2922924 2922925 2922926 2922927 2922928 2922929 2922930 2922931 2922932 2922933 2922934 2922935 2922936 2922937 2922938 2922939 2922940 2922941 2922942 2922943 

More information about this powerful tool can be found in its manpage by typing man debugfs. You can also type help inside its interactive shell to get a list of available commands.

Note: I am not sure about whether this tool performs well enough to be used to examine a whole partition at once. If you try that, you should probably not launch a new instance of debugfs per file to examine, but instead create a command script for it to run and use it with the the -f parameter.


The other way round to specify the block number and find which file it belongs to is also possible, but more complicated and it also can take a few seconds per step. Here's a transcript of an interactive debugfs session showing this:

$ sudo debugfs /dev/sda2
debugfs 1.43.4 (31-Jan-2017)
debugfs:  blocks /bin/ls
2922912 2922913 2922914 2922915 2922916 2922917 2922918 2922919 2922920 2922921 2922922 2922923 2922924 2922925 2922926 2922927 2922928 2922929 2922930 2922931 2922932 2922933 2922934 2922935 2922936 2922937 2922938 2922939 2922940 2922941 2922942 2922943 
debugfs:  icheck 2922912
Block   Inode number
2922912 914862
debugfs:  ncheck 914862
Inode   Pathname
914862  /bin/ls
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.