On Thu, Dec 18, 2014 at 3:24 PM, <meino.cra...@gmx.de> wrote: > Hi, > > with > > sysctl vm.block_dump=1 > > one can enable the logging of IO to the harddisk/flashmem/... > into dmesg. > The logs report the block number of the file in question... > but not the filename itsself. > > Is there any other way as examine each single file of the > filesystem to find the file to which a certain block number > is assigned? > > Thank you very mcuh for any help! > Best regards, > Meino > > >
That depends entirely on the filesystem being used. In the case of ext2/3/4, I believe /sbin/debugfs will do the trick with its icheck command to get the inode, and once you have the inode, you can get the filename via find. What I'm not 100% certain of is whether the block numbers involved map 1:1 with physical sectors, and how that plays with the 512B vs 4KB sectors, etc. With NTFS it's a hair quicker with ntfscluster and ntfsinfo doing the trick fairly trivially (I use a tool centered around that combo to identify files lost when I recover peoples windows drives with ddrescue). -- Poison [BLX] Joshua M. Murphy
