Skip to content

Instantly share code, notes, and snippets.

@sennajox
Last active September 17, 2019 01:52
Show Gist options
  • Save sennajox/4319528 to your computer and use it in GitHub Desktop.
Save sennajox/4319528 to your computer and use it in GitHub Desktop.
find the file by sector in filesystem
#!/bin/bash
# sector_list sample as below:
# 0
# 512
# 4087578
# 4087579
# 6324224
#
# You should build a sector_list firstly, and then execute this script to catch the files
# At the end of the task, it will tell you where the result is written to...
if [ $# -lt 2 ];then
echo "usage:$0 dev sector_list"
exit 1
fi
dev="$1"
sectorlist="$2"
outputfile="`date +%Y%m%d%H%M%S`.result"
# check the device
if [ ! -b "$dev" ]; then
echo "invalid device"
exit 1
fi
# check the file
if [ ! -f "$sectorlist" ];then
echo "$sectorlist is not existed"
exit 1
fi
# got the size of block
blksize=`debugfs -R 'stats' $dev | grep "Block size:" | awk '{print $3}'`
echo "blksize: $blksize"
sector_per_blk=`echo "$blksize / 512" | bc`
echo "sectors per block:$sector_per_blk"
tmp="$$.tmplog"
echo > $tmp
# scan the sectors in the list
while read line
do
sector=$(echo $line | awk '{print $1}')
# calc block
blk=`echo "$sector / $sector_per_blk" | bc`
#echo "$sector => $blk"
# find inode by block
inode=`debugfs -R "icheck $blk" $dev | grep -v debugfs | grep -v Inode | grep -v "not found" | awk '{print $2}'`
if [ "$inode" == "" ];then
#echo "blk $blk miss inode"
continue
fi
# find the file by inode
file=`debugfs -R "ncheck $inode" $dev | grep -v debugfs | grep -v Inode | awk '{print $2}'`
echo $file >> $tmp
done < "$sectorlist"
echo "result write into $outputfile"
cat $tmp | sort -u > $outputfile
rm -f $tmp
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment