debugfs 查找文件的 inode block 信息
NAME
debugfs - ext2/ext3/ext4 file system debugger
debugfs查找文件包含的block信息,例子:
进行了block号对应的inode 信息的验证,inode对应的文件名的验证
//切换root用户 //查找设备 [root@localhost jz]# df -h Filesystem Size Used Avail Use% Mounted on /dev/sda2 18G 4.3G 13G 26% / tmpfs 495M 0 495M 0% /dev/shm /dev/sda1 291M 58M 219M 21% /boot [root@localhost jz]# [root@localhost jz]# debugfs /dev/sda2 //输入对应的目录 debugfs 1.41.12 (17-May-2010) debugfs: cd /home/jz/ //切换目录 debugfs: pwd //查看当前目录信息 [pwd] INODE: 789624 PATH: /home/jz [root] INODE: 2 PATH: / debugfs: stat tem.zip //查看详细信息 Inode: 789463 Type: regular Mode: 0664 Flags: 0x80000 Generation: 2989385065 Version: 0x00000000:00000001 User: 500 Group: 500 Size: 99545 File ACL: 0 Directory ACL: 0 Links: 1 Blockcount: 200 Fragment: Address: 0 Number: 0 Size: 0 ctime: 0x5454e9fd:e7a6a864 -- Sat Nov 1 22:11:09 2014 atime: 0x544ca3ee:3a6ad26c -- Sun Oct 26 15:34:06 2014 mtime: 0x54436040:00000000 -- Sun Oct 19 14:54:56 2014 crtime: 0x544b1990:bdc9116c -- Sat Oct 25 11:31:28 2014 Size of extra inode fields: 28 Extended attributes stored in inode body: selinux = "unconfined_u:object_r:user_home_t:s0\000" (37) EXTENTS: //数据区的块号码 block号码 (0-24): 3198648-3198672 debugfs: icheck 3198648 //检查下3198648块对应的inode Block Inode number 3198648 789463 debugfs: ncheck 789463 //检查inode 789463对应的文件名称 Inode Pathname 789463 /home/jz/tem.zip debugfs: q //退出
上述一个个写命令太过麻烦,写了个shell 输入文件名,直接输出文件的信息.
open /dev/sda2
cd /home/jz
需要切换到对应的目录
//my.sh
#!/bin/bash echo "this is jz shell" read -p 'Please inupt file name: ' file_name debugfs << EOF open /dev/sda2 cd /home/jz stat $file_name q EOF exit 0
演示:
[root@localhost jz]# ./my.sh this is jz shell Please inupt file name: tem.zip debugfs 1.41.12 (17-May-2010) debugfs: open /dev/sda2 debugfs: cd /home/jz debugfs: stat tem.zip Inode: 789463 Type: regular Mode: 0664 Flags: 0x80000 Generation: 2989385065 Version: 0x00000000:00000001 User: 500 Group: 500 Size: 98345 File ACL: 0 Directory ACL: 0 Links: 2 Blockcount: 200 Fragment: Address: 0 Number: 0 Size: 0 ctime: 0x5454ef46:0b1d1e9c -- Sat Nov 1 22:33:42 2014 atime: 0x5454ee97:a5d8dc98 -- Sat Nov 1 22:30:47 2014 mtime: 0x5454eea4:1a5f4794 -- Sat Nov 1 22:31:00 2014 crtime: 0x544b1990:bdc9116c -- Sat Oct 25 11:31:28 2014 Size of extra inode fields: 28 Extended attributes stored in inode body: selinux = "unconfined_u:object_r:user_home_t:s0\000" (37) EXTENTS: (0-24): 442368-442392 debugfs: q [root@localhost jz]#
对文件的修改,复制对文件block影响的验证:
文件 tem.zip inode:789463 Size: 99545 block:(0-24): 3198648-3198672 [root@localhost jz]# cp tem.zip tem1.zip //复制文件 //复制后的文件tem1.zip //touch文件 文件信息没有发生变化 //vi 打开tem.zip 删除几行后的文件信息 block信息发生了完全的改变 [root@localhost jz]# ./my.sh this is jz shell Please inupt file name: tem.zip Inode: 789463 Size: 98345 EXTENTS: (0-24): 442368-442392 发现vi对文件信息,修改后不是在修改的,block块 改变,而是整个block号都发生了变化 //vi 删除一个字符,发现block也是完全改变 [root@localhost jz]# ./my.sh this is jz shell Please inupt file name: tem.zip debugfs 1.41.12 (17-May-2010) debugfs: open /dev/sda2 debugfs: cd /home/jz debugfs: stat tem.zip Inode: 789463 Size: 98344 EXTENTS: (0-24): 442400-442424 debugfs: q [root@localhost jz]#