you must have missed my "assuming the file is on /" comment.
try
you can also add -fstype ufs (or whatever your using) to avoid traversing the proc file system. your searching my inode so if you use / it will search all file systems. I suggest you limit your search to the file system that has your file.
Last edited by frank_rizzo; 12-08-2010 at 12:48 AM..
Reason: add comment
I have read quite a few threads here about the unix file creation date. I was interested in finding how to display it using a unix command. find did not help me so i looked at man inode. I found direction to htino.h which is described as the
structure of the inode for S51K (UNIX), HTFS, EAFS... (4 Replies)
How to get the filename of which has been deleted if I know the inode number.
i can use the command "istat" to get the inode number of the file.
# istat
/proc//fd/x
If this file has been deleted,but the process of this file has not been closed and handle has not been released ,so this... (3 Replies)
Hi everyone,
I am new here in www.unix.com, i found this site because I am looking for an answer to this problem of mine.
I need to know a UNIX command to display an inode's thread id and process id.
Hope someone can help me on this.
Thanks :D (8 Replies)
Hi All,
I am having a script which calculate checks the input feed and perform some function. When i am executing this script i am redirecting this to a output file. I want to know the redirected output file name inside my scripts. Is there is any way to get that .
like the same way we... (4 Replies)
Hello ,
I have to search for the file names which will either has ABC_DEF or NN in their filename
Please note that both cannot appear in the same file name
currently I am using
ls -lrt /zthetl/SrcFiles/*ABC_DEF*.xls| head -1 | nawk '{print $9}'
How to combine the NN in this code?... (4 Replies)
Hi All
How to answer the below interview question..
With a path and filename of "/mydir1/mydir2/mydir3/myfilenane.dat" write a UNIX script to display the filename (2 Replies)
Discussion started by: shumail
2 Replies
LEARN ABOUT DEBIAN
ffind
FFIND(1) General Commands Manual FFIND(1)NAME
ffind - Finds the name of the file or directory using a given inode
SYNOPSIS
ffind [-aduvV] [-f fstype] [-i imgtype] [-o imgoffset] [-b dev_sector_size] image inode
DESCRIPTION
ffind finds the names of files or directories that are allocated to inode on disk image image. By default it only will only return the
first name it finds. With some file systems, this will find deleted file names.
ARGUMENTS
image [images]
One (or more if split) disk or partition images whose format is given with '-i'.
inode Integer of inode to find.
The optional arguments are:
-a Find all occurrences of inode.
-d Find deleted entries only.
-f fstype
Identify the file system type of the image. Use '-f list' to list the supported file system types. If not given, autodetection
methods are used.
-u Find undeleted entries only.
-i imgtype
Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection
methods are used.
-o imgoffset
The sector offset where the file system starts in the image.
-b dev_sector_size
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or
512-bytes is assumed.
-v Verbose output to stderr.
-V Display version.
This program searches all directory entries looking for the given inode. This is useful when an inode has been identified from a disk unit
address using ifind(1).
EXAMPLE
# ffind -a image 212
SEE ALSO ifind(1)AUTHOR
Brian Carrier <carrier at sleuthkit dot org>
Send documentation updates to <doc-updates at sleuthkit dot org>
FFIND(1)