2

The inode structure of some filesystems includes a list of pointers to the blocks used to store the file contents. This list should exist for ext2/3/4, as specified in the first comment to this question.

The addresses of the blocks used by a file can be obtained with istat, one of the Sleuthkit tools: but this is not exactly a list of the pointers inside the inode, which should be 15 at most, while in this example they are more.

How to obtain such a list, for a given inode number?

1 Answer 1

1

If you have a file entry pointing to the inode, you can use debugfs:

$ debugfs /path/to/filesystem
debugfs: inode_dump -b fileentry
0000  0004 0000 0104 0000 0204 0000 0304 0000  ................
0020  0404 0000 0504 0000 0604 0000 0704 0000  ................
0040  0804 0000 0904 0000 0a04 0000 0b04 0000  ................
0060  2902 0000 2a02 0000 0000 0000            )...*.......

The -b flag causes inode_dump to only output i_block values, so these can be interpreted directly. Here the block numbers are 0x0400 through 0x040B (file blocks), then the indirect block at 0x0229, and the double-indirect block at 0x022A.

2
  • Thanks! IIUC, the "block numbers" are the actual pointers to the blocks. But how to know that they are exactly in those positions in the dump output? The inode structure contains some more information and metadata.
    – BowPark
    Aug 20, 2020 at 11:07
  • 1
    The -b option instructs inode_dump to only dump the i_block entries. Aug 20, 2020 at 11:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .