On Thu, Dec 18, 2014 at 3:24 PM,  <meino.cra...@gmx.de> wrote:
> Hi,
>
> with
>
>     sysctl vm.block_dump=1
>
> one can enable the logging of IO to the harddisk/flashmem/...
> into dmesg.
> The logs report the block number of the file in question...
> but not the filename itsself.
>
> Is there any other way as examine each single file of the
> filesystem to find the file to which a certain block number
> is assigned?
>
> Thank you  very mcuh for any help!
> Best regards,
> Meino
>
>
>

That depends entirely on the filesystem being used. In the case of
ext2/3/4, I believe /sbin/debugfs will do the trick with its icheck
command to get the inode, and once you have the inode, you can get the
filename via find. What I'm not 100% certain of is whether the block
numbers involved map 1:1 with physical sectors, and how that plays
with the 512B vs 4KB sectors, etc. With NTFS it's a hair quicker with
ntfscluster and ntfsinfo doing the trick fairly trivially (I use a
tool centered around that combo to identify files lost when I recover
peoples windows drives with ddrescue).

-- 
Poison [BLX]
Joshua M. Murphy

Reply via email to