1

Is there any way to find exactly the blocks allocated to a inode, and view that file? I don't care if I have to be on a live cd, but i need to do this for example:

cat verylongsentice > a
ls -i a
101010 a
ln a /some/random/path
rm a
inode_find 101010
verylongsentice

is there any way to do this? maybe as root or from a live cd? I do not care about the file name. Also would this be possible with deleted files?

9
  • You mean without using find . -xdev -inum 101010? Commented Jun 11, 2023 at 8:02
  • no. i need to actually open the file by inode. i do not need the file name. Commented Jun 11, 2023 at 8:06
  • 1
    Also read: Why is an open inode system call a security risk? Commented Jun 11, 2023 at 8:15
  • 1
    A "deleted file" means that the inode was deleted from the filesystem table, so that's definitely wouldn't be possible (unlss there is still a running process holding a file descriptor to this file). Moreover, there are some FS types that reuse an inode for a new file as soon as inode was released by a deleted file. Commented Jun 11, 2023 at 8:27
  • 1
    similar question: unix.stackexchange.com/questions/92816/… Commented Jun 11, 2023 at 9:27

1 Answer 1

2

There's no inode number for a deleted files. Also: Inode numbers are not guaranteed to be immutable, or not be reused immediately.

In the comments below your question you're very insistent that what you want should work. It shouldn't:

To open a file directly by inode nr and not through file name is in direct conflict with how the POSIX idea of a file works. It also would be incompatible with the POSIX permissions model, in which the path through which you access a file devices whether you can or cannot access it.

Therefore, the Linux kernel cannot offer you an API for opening files via inode.

In case the file does still exist, AND your file system actually stores inodes (I would guess most file systems do not store actual inode numbers, as that's a bad way to organize a large file system, but a remnant from the 1970s, probably. The file system driver would compute the inode nr from positions in directory tree structures, maybe, or something else), you could go in, and use find /mountpoint -i {number} to look for a file of that inode number on the whole file system. If it has already been deleted, it doesn't exist anymore, and you thus can't find it.

3
  • i dont care about the kernel api if the drive is not mounted, and the inode has not beenreused, why cant you just open the file? Commented Jun 11, 2023 at 8:46
  • Because it's not implemented that way, as explained in the answer. If you have a service program (e g. By writing one) for your specific file systems (as also explained, inode numbers are implementation details and not present in the storage format for all file systems to begin with), you certainly could just get the blocks/extents/metadata-stored contents of that file from the raw block device instead of through the Linux file system layer. But that program wouldn't be any more useful than the find approach, and it wouldn't offer the luxury of just opening the found file in any program. Commented Jun 11, 2023 at 8:51
  • I think you mistyped ”devices“. Also, I'd abbreviate ”number“ in uppercase (No or Nr). Commented Jun 11, 2023 at 9:17

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.