find / -xdev -inum <#> If you know it is in a directory more specific than /, replace / with that directory. inodes are only meaningful to ext2/3/4, but you can use the fs tools to find out where it is on disk.
On Thu, Dec 18, 2014 at 3:14 PM, Poison BL. <poiso...@gmail.com> wrote: > On Thu, Dec 18, 2014 at 3:24 PM, <meino.cra...@gmx.de> wrote: >> Hi, >> >> with >> >> sysctl vm.block_dump=1 >> >> one can enable the logging of IO to the harddisk/flashmem/... >> into dmesg. >> The logs report the block number of the file in question... >> but not the filename itsself. >> >> Is there any other way as examine each single file of the >> filesystem to find the file to which a certain block number >> is assigned? >> >> Thank you very mcuh for any help! >> Best regards, >> Meino >> >> >> > > That depends entirely on the filesystem being used. In the case of > ext2/3/4, I believe /sbin/debugfs will do the trick with its icheck > command to get the inode, and once you have the inode, you can get the > filename via find. What I'm not 100% certain of is whether the block > numbers involved map 1:1 with physical sectors, and how that plays > with the 512B vs 4KB sectors, etc. With NTFS it's a hair quicker with > ntfscluster and ntfsinfo doing the trick fairly trivially (I use a > tool centered around that combo to identify files lost when I recover > peoples windows drives with ddrescue). > > -- > Poison [BLX] > Joshua M. Murphy >
