2
How can I retrieve the block number(s) of a certain file in a file system (the blocks the file is using on the harddisc)?
I'm using the gentoo linux based SystemRescueCD, so I got plenty of tools installed which might get that information for me.
Best regards
watain
Posted 2010-02-28T18:31:28.787
Reputation: 611
1
If you're looking at Linux with ext2, ext3 or (probably) ext4, you want e2fsprogs, specifically the debugfs program.
For NTFS and FAT32, there may be Linux-based utils that will provide that information but you might also look into the Windows Defragmentation API, but there seems to be little information about it. Jeffrey Wall's C# wrappers for the Windows defragmentation API might be a good place to start, and the MyDefrag forums might also have some information of use.
Quick additional notes:
if you're working on NTFS and can run this in Windows, the command you want is DeviceIoControl, passing the FSCTL_GET_RETRIEVAL_POINTERS control code. More information on defragmentation and the API in Defragmenting Files (Windows).
Here's an amusing little walkthrough of tracking things down on an NTFS partition using a hex editor, a hex calculator, copious free time and some determination: Hex-Edit your way through the volume from the folks at the Linux-NTFS project.
fencepost
Posted 2010-02-28T18:31:28.787
Reputation: 1 086
What filesystem are you looking at? Is this a rescue of a Windows/NTFS system, an old FAT32 system, ext2, ext3, ext4, ReiserFS, etc.? The kind of information and tools may vary widely by filesystem. – fencepost – 2010-02-28T23:01:32.660