Originally Posted By: peter
Is there any way of finding out which file sector 115,459,753 belonged to, so that it can be deleted or re-transferred? Like ioctl(FIBMAP) but in reverse? I'm sure I've used one at some point, but can't remember what it was called or even whether it was actually on Linux or not...


No, not yet.

hdparm-8.7 will have built-in FIBMAP support when it is released, but even then it will not do reverse lookups.

I may write a program to try doing that though, which could be useful on empegs (but not likely on regular Linux boxes, because it would simply take too long to find the file).

EDIT: heck, just a shell script wrapper around hdparm-8.7 could do it rather easily, though slowly.

There's no reverse mapping mechanism, so it's basically a matter of just doing FIBMAP on each inode in turn, and comparing, until a match is found. One of the uglier aspects of filesystem forensics on Linux today.

Cheers


Edited by mlord (30/05/2008 17:37)