查找文件所在磁盘扇区

一、树莓派挂载优盘失败

提示信息已经可以很明显的看出挂在失败的原因，文件系统超级块存在问题，根本原因是U盘没有正确的格式化。

curtis@raspberrypi:/sys/class $ sudo mount /dev/sdb /mnt/
mount: /mnt: wrong fs type, bad option, bad superblock on /dev/sdb, missing codepage or helper program, or other error.

curtis@raspberrypi:/sys/class $ sudo mkfs.ext4 /dev/sdb
mke2fs 1.46.2 (28-Feb-2021)
Found a dos partition table in /dev/sdb
Proceed anyway? (y,N) y
Creating filesystem with 7680000 4k blocks and 1921360 inodes
Filesystem UUID: 58506ab8-491f-4d42-a643-1fe7576d742f
Superblock backups stored on blocks:
        32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
        4096000

Allocating group tables: done
Writing inode tables: done
Creating journal (32768 blocks):
done
Writing superblocks and filesystem accounting information:
done

格式化之后尝试挂在优盘，挂载成功。

curtis@raspberrypi:/sys/class $ sudo mount /dev/sdb /mnt/
curtis@raspberrypi:/sys/class $ df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/root       118G  3.9G  109G   4% /
devtmpfs        3.6G     0  3.6G   0% /dev
tmpfs           3.9G     0  3.9G   0% /dev/shm
tmpfs           1.6G  1.2M  1.6G   1% /run
tmpfs           5.0M  4.0K  5.0M   1% /run/lock
/dev/sda1       255M   57M  199M  23% /boot
tmpfs           781M   20K  781M   1% /run/user/1000
/dev/sdb         29G   24K   28G   1% /mnt

树莓派重启之后，U盘被自动挂载。

curtis@raspberrypi:~ $ df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/root       118G  3.8G  109G   4% /
devtmpfs        3.6G     0  3.6G   0% /dev
tmpfs           3.9G     0  3.9G   0% /dev/shm
tmpfs           1.6G  1.2M  1.6G   1% /run
tmpfs           5.0M  4.0K  5.0M   1% /run/lock
/dev/sda1       255M   57M  199M  23% /boot
tmpfs           781M   20K  781M   1% /run/user/1000
/dev/sdb         29G   28K   28G   1% /media/curtis/58506ab8-491f-4d42-a643-1fe7576d742f

二、debugfs

2.1 基本用法

在 Linux 中，可以使用 debugfs 工具来查找文件所在的磁盘扇区。具体步骤如下：

debugfs:  help
Available debugfs requests:

show_debugfs_params, params
                         Show debugfs parameters
open_filesys, open       Open a filesystem
close_filesys, close     Close the filesystem
freefrag, e2freefrag     Report free space fragmentation
feature, features        Set/print superblock features
dirty_filesys, dirty     Mark the filesystem as dirty
init_filesys             Initialize a filesystem (DESTROYS DATA)
show_super_stats, stats  Show superblock statistics
ncheck                   Do inode->name translation
icheck                   Do block->inode translation
change_root_directory, chroot
                         Change root directory
change_working_directory, cd
                         Change working directory
list_directory, ls       List directory
show_inode_info, stat    Show inode information
dump_extents, extents, ex
                         Dump extents information
blocks                   Dump blocks used by an inode
filefrag                 Report fragmentation information for an inode
link, ln                 Create directory link
unlink                   Delete a directory link
mkdir                    Create a directory
rmdir                    Remove a directory
rm                       Remove a file (unlink and kill_file, if appropriate)
kill_file                Deallocate an inode and its blocks
copy_inode               Copy the inode structure
clri                     Clear an inode's contents
freei                    Clear an inode's in-use flag
seti                     Set an inode's in-use flag
testi                    Test an inode's in-use flag
freeb                    Clear a block's in-use flag
setb                     Set a block's in-use flag
testb                    Test a block's in-use flag
modify_inode, mi         Modify an inode by structure
find_free_block, ffb     Find free block(s)
find_free_inode, ffi     Find free inode(s)
print_working_directory, pwd
                         Print current working directory
expand_dir, expand       Expand directory
mknod                    Create a special file
list_deleted_inodes, lsdel
                         List deleted inodes
                         
write                    Copy a file from your native filesystem
dump_inode, dump         Dump an inode out to a file
cat                      Dump an inode out to stdout
lcd                      Change the current directory on your native filesystem
rdump                    Recursively dump a directory to the native filesystem
set_super_value, ssv     Set superblock value
set_inode_field, sif     Set inode field
set_block_group, set_bg  Set block group descriptor field
logdump                  Dump the contents of the journal
htree_dump, htree        Dump a hash-indexed directory
dx_hash, hash            Calculate the directory hash of a filename
dirsearch                Search a directory for a particular filename
bmap                     Calculate the logical->physical block mapping for an inode
fallocate                Allocate uninitialized blocks to an inode
punch, truncate          Punch (or truncate) blocks from an inode by deallocating them
symlink                  Create a symbolic link
imap                     Calculate the location of an inode
dump_unused              Dump unused blocks
set_current_time         Set current time to use when setting filesystem fields
supported_features       Print features supported by this version of e2fsprogs
dump_mmp                 Dump MMP information
set_mmp_value, smmp      Set MMP value
extent_open, eo          Open inode for extent manipulation
zap_block, zap           Zap block: fill with 0, pattern, flip bits etc.
block_dump, bdump, bd    Dump contents of a block
ea_list                  List extended attributes of an inode
ea_get                   Get an extended attribute of an inode
ea_set                   Set an extended attribute of an inode
ea_rm                    Remove an extended attribute of an inode
list_quota, lq           List quota
get_quota, gq            Get quota
inode_dump, idump, id    Dump the inode structure in hex
journal_open, jo         Open the journal
journal_close, jc        Close the journal
journal_write, jw        Write a transaction to the journal
journal_run, jr          Recover the journal
help                     Display info on command or topic.
list_requests, lr, ?     List available commands.
quit, q                  Leave the subsystem.

支持的文件系统类型

• ext2/ext3/ext4 文件系统：debugfs 最初是为 ext2 文件系统设计的，后来扩展支持了 ext3 和 ext4 文件系统。它提供了与 ext 文件系统相关的功能，如查看和修改文件系统的超级块、组描述符、索引节点等。

• JFS 文件系统：debugfs 也提供了对 JFS（Journaled File System）文件系统的支持。您可以使用 debugfs 与 JFS 文件系统进行交互，并执行调试操作，如查看和修改超级块、索引节点等。

• XFS 文件系统：debugfs 还可以用于与 XFS（eXtended File System）文件系统进行调试。它提供了对 XFS 文件系统的访问和操作功能，如查看和修改文件系统的元数据、目录结构等。

首先，创建一个文件，并使用 df 命令查看文件所在的文件系统和挂载点，例如：

root@raspberrypi:/media/curtis/58506ab8-491f-4d42-a643-1fe7576d742f# echo "this is test string !" > /mnt/test.txt
root@raspberrypi:/media/curtis/58506ab8-491f-4d42-a643-1fe7576d742f# df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/root       118G  3.9G  109G   4% /
devtmpfs        3.6G     0  3.6G   0% /dev
tmpfs           3.9G     0  3.9G   0% /dev/shm
tmpfs           1.6G  1.2M  1.6G   1% /run
tmpfs           5.0M  4.0K  5.0M   1% /run/lock
/dev/sda1       255M   57M  199M  23% /boot
tmpfs           781M   20K  781M   1% /run/user/1000
/dev/sdb         29G   28K   28G   1% /media/curtis/58506ab8-491f-4d42-a643-1fe7576d742f

可以看到，文件所属的块设备为 /dev/sdb，挂载点是/media/curtis/58506ab8-491f-4d42-a643-1fe7576d742f。

使用 debugfs 命令进入文件系统的调试模式。

root@raspberrypi:/media/curtis/58506ab8-491f-4d42-a643-1fe7576d742f# debugfs /dev/sdb
debugfs 1.46.2 (28-Feb-2021)
debugfs:

2.2 逻辑扇区获取

接着，使用 show_inode_info, stat Show inode information命令查找文件的相关信息，既可以用show_inode_info，也可以用stat，参数为文件路径，如下所示：

debugfs:  show_inode_info
show_inode_info: Usage: show_inode_info <file>

debugfs:  show_inode_info ./test.txt
Inode: 12   Type: regular    Mode:  0644   Flags: 0x80000
Generation: 1226487998    Version: 0x00000000:00000001
User:     0   Group:     0   Project:     0   Size: 22
File ACL: 0
Links: 1   Blockcount: 8
Fragment:  Address: 0    Number: 0    Size: 0
 ctime: 0x649c423b:9e1f8fb0 -- Wed Jun 28 15:22:51 2023
 atime: 0x649c447c:132b1038 -- Wed Jun 28 15:32:28 2023
 mtime: 0x649c423b:9e1f8fb0 -- Wed Jun 28 15:22:51 2023
crtime: 0x649c423b:9e1f8fb0 -- Wed Jun 28 15:22:51 2023
Size of extra inode fields: 32
Inode checksum: 0x259775cf
EXTENTS:
(0):34816

2.3 inode_info 字段信息说明

1. Inode 相关信息：
   • Inode 号码：Inode: 12
   • 类型：Type: regular
   • 文件权限：Mode: 0644
   • 标志：Flags: 0x80000
   • 生成号：Generation: 1226487998
   • 版本号：Version: 0x00000000:00000001
   • 用户 ID：User: 0
   • 组 ID：Group: 0
   • 项目 ID：Project: 0
   • 文件大小：Size: 22
   • 文件 ACL：File ACL: 0
   • 硬链接数：Links: 1
   • 分配的块数：Blockcount: 8
   • 分片信息：Fragment: Address: 0 Number: 0 Size: 0
2. 时间戳信息：
   • 创建时间：crtime: 0x649c423b:9e1f8fb0 – Wed Jun 28 15:22:51 2023
   • 修改时间：mtime: 0x649c423b:9e1f8fb0 – Wed Jun 28 15:22:51 2023
   • 访问时间：atime: 0x649c447c:132b1038 – Wed Jun 28 15:32:28 2023
   • 变化时间：ctime: 0x649c423b:9e1f8fb0 – Wed Jun 28 15:22:51 2023
3. 额外 Inode 字段信息：
   • 额外 Inode 字段大小：Size of extra inode fields: 32
   • Inode 校验和：Inode checksum: 0x259775cf
4. EXTENTS：逻辑块的信息：
   • 逻辑块号：(0):34816
     LBA地址是相对于文件系统来讲，而不是实际磁盘。

Logical block addressing (LBA) is a common scheme used for specifying the location of blocks of data stored on computer storage devices, generally secondary storage systems such as hard disk drives. LBA is a particularly simple linear addressing scheme; blocks are located by an integer index, with the first block being LBA 0, the second LBA 1, and so on.

2.4 文件系统块大小获取

可以看到，文件的 inode 号是 12，EXTENTS代表的是文件所在的逻辑扇区号，有可能是连续，也有可能不连续。

Filesystem volume name:   <none>
Last mounted on:          /media/curtis/58506ab8-491f-4d42-a643-1fe7576d742f
Filesystem UUID:          58506ab8-491f-4d42-a643-1fe7576d742f
Filesystem magic number:  0xEF53
Filesystem revision #:    1 (dynamic)
Filesystem features:      has_journal ext_attr resize_inode dir_index filetype needs_recovery extent 64bit flex_bg sparse_super large_file huge_file dir_nlink extra_isize metadata_csum
Filesystem flags:         unsigned_directory_hash
Default mount options:    user_xattr acl
Filesystem state:         clean
Errors behavior:          Continue
Filesystem OS type:       Linux
Inode count:              1921360
Block count:              7680000
Reserved block count:     384000
Overhead clusters:        164642
Free blocks:              7515351
Free inodes:              1921348
First block:              0
Block size:               4096	<----- 块大小
Fragment size:            4096
Group descriptor size:    64
Reserved GDT blocks:      1024
Blocks per group:         32768
Fragments per group:      32768
Inodes per group:         8176
Inode blocks per group:   511
Flex block group size:    16
Filesystem created:       Wed Jun 28 15:17:43 2023
Last mount time:          Wed Jun 28 15:31:31 2023
Last write time:          Wed Jun 28 15:31:31 2023
Mount count:              3
Maximum mount count:      -1
Last checked:             Wed Jun 28 15:17:43 2023
Check interval:           0 (<none>)
Lifetime writes:          474 MB
Reserved blocks uid:      0 (user root)
Reserved blocks gid:      0 (group root)
First inode:              11
Inode size:               256
Required extra isize:     32
Desired extra isize:      32
Journal inode:            8
Default directory hash:   half_md4
Directory Hash Seed:      0244c6ea-db9b-4c0a-87ea-eb125174e179
Journal backup:           inode blocks

2.5 数据读取

尝试直接从磁盘中读取文件数据，看看从inode中获取的信息是不是正确，因为EXTENTS表述的是逻辑扇区号，所以需要获取文件系统的块大小，如上所示，文件系统的块大小为4k。

root@raspberrypi:/home/curtis# dd if=/dev/sdb of=./test.img skip=34816 bs=4k count=2 iflag=direct
2+0 records in
2+0 records out
8192 bytes (8.2 kB, 8.0 KiB) copied, 0.00219406 s, 3.7 MB/s
root@raspberrypi:/home/curtis# hexdump ./test.img
0000000 6874 7369 6920 2073 6574 7473 7320 7274
0000010 6e69 2067 0a21 0000 0000 0000 0000 0000
0000020 0000 0000 0000 0000 0000 0000 0000 0000
*
0002000

从读出来的信息来看，正确从磁盘读到了test.txt的数据。