Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I know of this command:

find /path/to/mountpoint -inum <inode number>

but it is a very slow search, I feel like there has to be a faster way to do this. Does anybody know a faster method?

share|improve this question
    
This is my first time seeing a search using inode. When do you need to search by inode ? –  Coren Mar 29 '12 at 8:53
    
@Coren - it's commonly used if you have a file with, say, a "-" in front. You can do ls -li to find the inode of it, then: find . -inum <inode> -exec rm -i {} \; This is a belt-and-bracers approach to ensuring you can remove the file. Of course, you could also 'rm -- -filename', or rm ./-filename, or rm "-filename". –  swisscheese Mar 29 '12 at 10:51
    
@Coren with selinux, log messages include the inode, but not the full path. So you have to search for the inode to find the file being referred to. (thats my use case anyway) –  Patrick Mar 29 '12 at 13:30
1  
@Coren For example when a file has multiple hard links, you've spotted that the contents are obsolete and want to delete the file, but you've only found one of the file's names and want to delete the others. –  Gilles Mar 29 '12 at 22:21
    
On many filesystems, there's no faster way, because the only way to find a file's name is to traverse the directory tree that leads to it. –  Gilles Mar 29 '12 at 22:22

3 Answers 3

You could look at the fsdb command, found on most Unices, and available somewhere for Linux I am sure. This is a powerful command allowing you to to access the in-core inode structure of files, so be careful. The syntax is also very terse.

fsdb for AIX

fsdb re-link file on Solaris

While fsdb won't actually let you discover the filename of the inode, it does allow you to directly access the inode when you specify it, in essence "porting" you to the file itself (or at least it's data block pointers) so it's quicker in that respect than the find ;-).
Your question doesn't specify what you want to do with the file. Are you perchance decoding NFS filehandles?

sc.

share|improve this answer
    
Well, I didn't think what I was going to do with the information was relevant to my question, so I left it out. In my case, it was merely a curiosity question; my xfs_fsr defragmentation spits out which inodes it defragments, and one was extremely fragmented (over 5000 extents) and I was just curious which file it was. find works, it's just so slow. –  Alex Mar 30 '12 at 7:48

For an ext4 filesystem, you can use debugfs as in the following example:

$ sudo debugfs -R 'ncheck 393094' /dev/sda2 2>/dev/null
Inode   Pathname
393094  /home/enzotib/examples.desktop

The answer is not immediate, but seem to be better than find.
The output obtained can be easily parsed to obtain the filename.

share|improve this answer
    
I should probably have specified the filesystem type. It didn't occur to me that the method of doing these things would be different for different filesystems. I'm using XFS, so while I'm sure your answer is correct, it won't help me specifically. –  Alex Mar 30 '12 at 7:39

Somewhere in the machine, there is a list of all INODEs.

This problem is analogous to a phone book. It is a list of names, and the phone numbers might be used by more than one person. If you want to look up by number, to see who shares that number, it's going to take a long time to unless somebody creates a reverse-lookup phone book.

Better to create a reverser-lookup database, organized like the reverse-lookup phone book.

This problem can be solved with two scripts (I'm not much of a programmer... you'd probably laugh at that code I write).

SCRIPT1: Create the reverse-lookup table. Do a "find" on all files, and make a two column table of INODE,FILENAME. Sort and combine into an array, the FILENAMES which share the same INODE number.

(you could build a binary tree, and make access to your new list screaming fast).

SCRIPT2: Searches your new reverse-list, and pulls out the array of FILENAMES.

The only real drawback, is that you can't do this in real-time. INODES always change, and if you need up-to-the-minute information, you'll have to re-generate your table.

share|improve this answer
    
INODES do not "always change". On fact I doubt that in any Unix filesystem the inode associated to a file EVER changes. At least I can mot figure a reason why it should: teaching.idallen.com/dat2330/04f/notes/links_and_inodes.html –  Angel O'Sphere Jul 12 at 13:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.