I would like to know which file occupies a given block on a blockdevice.
The procedure should at least support ext4 on Encrypted LVM, but it would be delicious if it also explained how to do this for other storage systems.
So I am looking for something like:
# whichfile /dev/sda 123456789 /var/log/syslog
# whichfile -v /dev/sda 123456789 Debug: Block 123456789 is in partition /dev/sda6 Debug: /dev/sda6 is part of LVM /dev/kubuntu-vg/root Debug: /dev/kubuntu-vg/root is LUKS encrypted Debug: Decrypted device is: /dev/mapper/kubuntu--vg-root Debug: Block 123456789 on /dev/sda is block 98765432 on /dev/mapper/kubuntu--vg-root Debug: File system is: ext4 Debug: Block 98765432 contains inode 2345678 Debug: Inode 2345678 is var/log/syslog Debug: Mount point is: / /var/log/syslog
@Mark Plotnick has a partial solution for going from unencrypted blockdevice to inode. That is one step in the right direction.
Another partial solution: inode -> filename (ext4):
sudo debugfs -R 'ncheck 23456789' /dev/unencrypted_ext4_fs
and more general (slow - but might just work on any inode based file system):
sudo find /mountpoint-for-device -xdev -inum 23456789