Linux

47952 readers

2565 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
No misinformation
No NSFW content
No hate speech, bigotry, etc

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago

MODERATORS

[email protected]

FOUND file in device by hex content using wxHexEditor (lemmy.nz)

submitted 11 months ago* (last edited 11 months ago) by [email protected] to c/[email protected]

9 comments fedilink hide all child comments

Just having a play around, this turned out to be not as clear cut as expected.

so I created a file and entered some text, used xxd to get the hex values, and then opened the device /dev/sdb1 in wxhexeditor and tried to find my file, but it's not finding it. Inode is 19, so it should be right at the start of the first block group, but after several minutes, no joy. (drive is ext4.)

I thought this was going to be an easy task, just multiply the inode by the block size, open the device with wxhexeditor, and scroll to the line corresponding to the calculated byte, copy out the hex values and convert to ascii and voila, there's the 'hello world'... except no.

What am I missing here? Drive isn't encrypted, nothing silly like that.

Ok, I managed to do it with dd:

sudo dd if=/dev/sdb1 bs=8M skip=$((4660742*4096)) iflag=skip_bytes | head -c 4096

hello

but why can I not find it using wxhexeditor??

EDIT:

Duh, I didn't click that offset needed to be multiplied by the block size.

If I go to offset 4660742*4096=19090399232 in wxhexeditor, indeed I see the file contents:

Final conclusion:

After some more testing, I have concluded: you cannot easily calculate the offset using the inode. Finding files across the disk requires using the inode tables to get the offset and actual file location. So an inode does not correlate with a physical/logical sequential disk location.

I created a new file, it received inode 21, but the offset was smaller than inode 19.

Was that a good use of 3 hours of my life? Well... I still have no idea what's up with the Kardashians, so.. I guess?

all 11 comments

sorted by: hot top controversial new old

[–] [email protected] 11 points 11 months ago (1 children)

Luthis, you're doing God's work here. You are learning by experimentation and then, importantly, documenting and sharing what you've learned. There is absolutely zero wrong and only good to be had in either of those and in combining them, you're doing service to our entire community.

[–] [email protected] 1 points 11 months ago

Thanks! I will keep it up!

[–] [email protected] 6 points 11 months ago

Sounds like a good time to me!! Hey and look at all that wasted space you found 😹

[–] [email protected] 5 points 11 months ago (1 children)

Of course that was worth 3 hours. Every tinkering/experimenting is worth it. In the worst case you gain experience

[–] [email protected] 3 points 11 months ago

Yeah now I stand a better chance of recovering files if something catastrophic happens

[–] [email protected] 5 points 11 months ago (1 children)

You wasted three hours so you can share this knowledge :D

[–] [email protected] 3 points 11 months ago

True, now you have the power to find your files manually!

[–] [email protected] 3 points 11 months ago* (last edited 11 months ago)

Tried a different way:

 filefrag -v testfile 
Filesystem type is: ef53
File size of testfile is 6 (1 block of 4096 bytes)
 ext:     logical_offset:        physical_offset: length:   expected: flags:
   0:        0..       0:    4660742..   4660742:      1:             last,eof

Went to offset 4660742 in wxhexeditor, but still when I copy out the hex and convert to ascii, it's nonsense