诉求:想要找到一个文件存放在物理磁盘的哪个扇区?
验证思路:在/目录下创建一个文件test,并且写入测试字符串,使用debugfs的方式查看文件所对应的扇区。
- bebugfs是什么。
看看debugfs支持哪些文件系统,从结果来看仅支持ext家族,猜想是不是每种文件系统都会维护自己的调试工具??。
debugfs - ext2/ext3/ext4 file system debugger
好巧,测试的文件系统是ext4(ext4用的最广泛?)
root@rlk:/# findmnt
TARGET SOURCE FSTYPE OPTIONS
/ /dev/sda5 ext4 rw,relatime,errors=remount-ro
├─/sys sysfs sysfs rw,nosuid,nodev,noexec,relatime
│ ├─/sys/kernel/security securityfs securityfs rw,nosuid,nodev,noexec,relatime
│ ├─/sys/fs/cgroup tmpfs tmpfs ro,nosuid,nodev,noexec,mode=755
......
- 往测试文件写点测试数据并找到文件所在的挂载点。
root@rlk:/# echo "this is test string!!!" > test
echo "this is test stringls!" > test
root@rlk:/# df test
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/sda5 1029518584 23992112 953160088 3% /
- 使用debugfs查看文件的基本信息。
注意:stat后的参数是刨去挂载点之后的路径。
root@rlk:/# debugfs /dev/sda5
debugfs 1.45.5 (07-Jan-2020)
debugfs: cd /root # 需要cd到文件所在路径或者跟文件的全路径。
debugfs: stat test
Inode: 22 Type: regular Mode: 0644 Flags: 0x80000
Generation: 213671614 Version: 0x00000000:00000001
User: 0 Group: 0 Project: 0 Size: 23
File ACL: 0
Links: 1 Blockcount: 8
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x642441cf:d35e13a4 -- Wed Mar 29 21:49:03 2023
atime: 0x642441cf:d35e13a4 -- Wed Mar 29 21:49:03 2023
mtime: 0x642441cf:d35e13a4 -- Wed Mar 29 21:49:03 2023
crtime: 0x642441cf:d35e13a4 -- Wed Mar 29 21:49:03 2023
Size of extra inode fields: 32
Inode checksum: 0x17e647f7
EXTENTS:
(0):34147
- 确定文件系统的块大小
root@rlk:/# tune2fs -l /dev/sda5 | grep "Block size"
Block size: 4096
- 读取对应扇区数据。
对于/dev/sda5磁盘分区来讲,文件存放的block offset为34147,也就是说EXTENTS下的偏移为块偏移,转换算成扇区就是第34147*8=273176个扇区。
方式一;
root@rlk:/# dd if=/dev/sda5 of=./test.img bs=4k count=1 skip=34147
1+0 records in
1+0 records out
4096 bytes (4.1 kB, 4.0 KiB) copied, 0.000373013 s, 11.0 MB/s
方式二:
root@rlk:/# dd if=/dev/sda5 of=./test.img bs=512 count=1 skip=273176
1+0 records in
1+0 records out
512 bytes copied, 0.000305426 s, 1.7 MB/s
root@rlk:/# hexedit ./test.img
00000000 74 68 69 73 20 69 73 20 74 65 73 74 20 73 74 72 69 6E 67 6C 73 21 0A 00 this is test stringls!..
00000018 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........................
00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........................
00000048 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........................
00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........................
00000078 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........................
00000090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........................
000000A8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........................
000000C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........................
000000D8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........................
000000F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........................
00000108 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........................
00000120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........................
00000138 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........................
00000150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........................
00000168 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........................
......