The OpenNET Project / Index page

[ новости /+++ | форум | wiki | теги | ]

Поиск:  Каталог документации

4. Finding inodes for deleted directories

We will try to find out the inode numbers of the deleted directories.

        # debugfs /dev/hdy1

Walk to that place in the structure where the directories were located before the deletion. You can use ls and cd inside debugfs.

        debugfs: ls -l

Example of output from the above command.

        179289  20600      0      0       0 17-Feb-100 18:26 file-1
        918209  40700    500    500    4096 16-Jan-100 15:18 file-2
        160321  41777      0      0    4096  3-Jun-100 06:13 file-3
        177275  60660      0      6       0  5-May-98  22:32 file-4
        229380 100600    500    500   89891 19-Dec-99  15:40 file-5
        213379 120777      0      0      17 16-Jan-100 14:24 file-6

Description of the fields.

  1. Inode number.

  2. First two (or one) numbers represents the kind of inode we got:

    2 = Character device

    4 = Directory

    6 = Block device

    10 = Regular file

    12 = Symbolic link

    Last four numbers are the usual Unix rights.

  3. Owner in number representation.

  4. Group in number representation.

  5. Size in bytes.

  6. Date (Here we can see the Y2K bug =)).

  7. Time.

  8. Filename.

Now dump the mother directory to disk. Here inode is the corresponding inode number (do not forget the '<' and '>').

        debugfs: dump <inode> debugfs-dump

Get out of debugfs.

        debugfs: quit




Партнёры:
PostgresPro
Inferno Solutions
Hosting by Hoster.ru
Хостинг:

Закладки на сайте
Проследить за страницей
Created 1996-2024 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру