3
1
Just like every file also directories have file id. You can see them by typing
ls -i
How do I view file content by its id?
How do I change directory attribute to file (remove D) and vice versa!
0xDEAD BEEF
Posted 2010-06-16T10:32:36.927
Reputation: 201
1
Sounds like the data you are looking for is in the filesystem. The answer to your question depends on which filesystem you are using. I'll assume you are using ext3.
For advanced ability to view and modify data in the filesystem, see the debugfs(8). But careful, you could really corrupt things with this tool. This is a good opportunity to use a Virtual Machine with snapshots (Like I recommended here). Take a snapshot, and then modify the filesystem as much as you want. You can always restore the VM from an earlier snapshot.
Stefan Lasiewski
Posted 2010-06-16T10:32:36.927
Reputation: 2 881
Great! I used debugfs /dev/disk/by-id/.., then issued command cat <inode> and got contents of inode! However at that point i got confused - i saw no file properties in inode. Only data. Then i did same for directory, but it also did not contain file properties so question is - where are file properties stored then? – 0xDEAD BEEF – 2010-06-17T07:46:44.533
Ok! solved. Used debugfs mi (modify inode) before opening debugws with -w parameter. That command allows me to modify inode, while cat and dump only retrieve data, that inode is pointing to! That was total fun! – 0xDEAD BEEF – 2010-06-17T08:06:57.203
Lieliski!. And that is advanced stuff. Oddly, I have rarely done that stuff during my career (I've been doing this for almost 13 years) except back when I was teaching myself Linux. Now it's time to learn again. – Stefan Lasiewski – 2010-06-17T17:06:36.773
2
inode to filename:
find / -inum <number>
Converting a directory to a file is impossible.
For information about directory internal data, see dirent.h.
You can also consult the GNU C Library as regarding Accessing Directories .
harrymc
Posted 2010-06-16T10:32:36.927
Reputation: 306 093
i want to see, what is directory, how it is stored in linux system. find / -inum is certainly not the thing i am after – 0xDEAD BEEF – 2010-06-16T10:57:46.010
@0xDEAD BEEF: I've added some more info that can serve as a starting point. These are advanced Linux topics, which require real study. – harrymc – 2010-06-16T11:27:18.623
i remember old time ago i was able to edit information, that was stored in hard/or soft link. So i was able to gain access to directory node (for example). thus, having link to file with inode to directory. But today i have forgoten all of that magic.. :( – 0xDEAD BEEF – 2010-06-16T11:40:17.297
0
-- solution and how stuff works -- So - inode is the thing to which every directory has record to. In fact - each directory is file, which contains list of file names and corresponding inode numbers for them,
So - if you want to see, what is inside directory inode here is how you do it -
1) open debugfs with your hdd. I found mine under /dev/disks/by-id/..
debugfs ATA-434...blalbalba
then typecat <inode number>
orcat filename
ordump <inode number> outfile
and you will get data of that inode!
But wait! That is not it!
inode actualy contians no data. It contains pointers to data (block numbers). What inode actualy contains is file mode, attributes, owner, group, size, links and many more! Nice thing? We can use debugfs not only to see that data, but also to modify it!
Here is how you do it!
1) open debugfs in write mode debugfs -w ATA4249...blalbla
2) open inode in modify mode and modify/see all fields you like
mi <inode number>
Thats it!
0xDEAD BEEF
Posted 2010-06-16T10:32:36.927
Reputation: 201
1"inode", not "id". – Ignacio Vazquez-Abrams – 2010-06-16T10:35:31.820