How to get the filename of which has been deleted if I know the inode number?


 
Thread Tools Search this Thread
Operating Systems AIX How to get the filename of which has been deleted if I know the inode number?
# 1  
Old 11-25-2009
How to get the filename of which has been deleted if I know the inode number?

How to get the filename of which has been deleted if I know the inode number.

i can use the command "istat" to get the inode number of the file.
Code:
# istat
/proc/[pid]/fd/x

If this file has been deleted,but the process of this file has not been closed and handle has not been released ,so this file has not been released yet.

then ,how can i get the path of which it has been deleted before if i know the inode number in AIX?

Thank you very much!

Last edited by zaxxon; 12-01-2009 at 07:33 AM.. Reason: code tags
# 2  
Old 11-25-2009
If the file is open, would "lsof" help? You could list all files opened by the process.
# 3  
Old 11-25-2009
Quote:
Originally Posted by garethr
If the file is open, would "lsof" help? You could list all files opened by the process.
i have tried both in AIX and LINUX.
I can't get the path by using "lsof" in AIX,but it works well in LINUX.
Thank you Garethr!

---------- Post updated at 07:08 PM ---------- Previous update was at 05:44 PM ----------

I make a test here.
the file "test" under /home is deleted when it runs on "nohup".
because of the handle of "test" is not released so taht The space of /home is not released after deleted "test".

IF ADMINISTRATOR DOESN'T KNOW WHO REMOVED THE "test" AND WHAT THE REMOVED FILENAME IS,HE JUST CAN INPUT"fuser -dV /home" AND GET an INODE NUMBER,HOW CAN HE GET THIS FILENAME "test".

thankyou!

Code:
[p615:root:/home] df -k
Filesystem    1024-blocks      Free %Used    Iused %Iused Mounted on
/dev/hd4          5242880   4250220   19%     5537     1% /
/dev/hd2          2162688     64712   98%    44752    71% /usr
/dev/hd9var        262144    162600   38%     4566    12% /var
/dev/hd3          2097152   1626384   23%      214     1% /tmp
/dev/hd1           786432    785776    1%       26     1% /home
/proc                   -         -    -         -     -  /proc
/dev/hd10opt       131072     45776   66%     1711    14% /opt
/dev/informix_lv     3145728   1897000   40%     5255     2% /informix
/dev/setup_lv     4194304   3246572   23%      499     1% /setup
[p615:root:/home] nohup vmstat 1 10000 > test &
[2]     364720
[p615:root:/home] df -k
Filesystem    1024-blocks      Free %Used    Iused %Iused Mounted on
/dev/hd4          5242880   4250220   19%     5537     1% /
/dev/hd2          2162688     64712   98%    44752    71% /usr
/dev/hd9var        262144    162600   38%     4566    12% /var
/dev/hd3          2097152   1626384   23%      214     1% /tmp
/dev/hd1           786432    785772    1%       27     1% /home
/proc                   -         -    -         -     -  /proc
/dev/hd10opt       131072     45776   66%     1711    14% /opt
/dev/informix_lv     3145728   1897000   40%     5255     2% /informix
/dev/setup_lv     4194304   3246572   23%      499     1% /setup
[p615:root:/home] rm test
[p615:root:/home] df -k
Filesystem    1024-blocks      Free %Used    Iused %Iused Mounted on
/dev/hd4          5242880   4250220   19%     5537     1% /
/dev/hd2          2162688     64712   98%    44752    71% /usr
/dev/hd9var        262144    162600   38%     4566    12% /var
/dev/hd3          2097152   1626384   23%      214     1% /tmp
/dev/hd1           786432    785772    1%       27     1% /home
/proc                   -         -    -         -     -  /proc
/dev/hd10opt       131072     45776   66%     1711    14% /opt
/dev/informix_lv     3145728   1897000   40%     5255     2% /informix
/dev/setup_lv     4194304   3246572   23%      499     1% /setup
[p615:root:/home] fuser -dV /home
/home:
inode=4      size=3040         fd=1      364720
[p615:root:/home] istat 4 /home
Inode 4 on device 10/8  Unallocated Inode
Owner: 0(root)          Group: 0(system)
Link count:   0         Length 1086 bytes
Last updated:   Wed Nov 25 17:56:49 BEIST 2009
Last modified:  Wed Nov 25 17:56:49 BEIST 2009
Last accessed:  Wed Nov 25 17:56:32 BEIST 2009
Block pointers (hexadecimal):
22
[p615:root:/home] istat 4 /dev/hd1
Inode 4 on device 10/8  Unallocated Inode
Owner: 0(root)          Group: 0(system)
Link count:   0         Length 1086 bytes
Last updated:   Wed Nov 25 17:56:49 BEIST 2009
Last modified:  Wed Nov 25 17:56:49 BEIST 2009
Last accessed:  Wed Nov 25 17:56:32 BEIST 2009
Block pointers (hexadecimal):
22
[p615:root:/home] df -k
Filesystem    1024-blocks      Free %Used    Iused %Iused Mounted on
/dev/hd4          5242880   4250220   19%     5537     1% /
/dev/hd2          2162688     64712   98%    44752    71% /usr
/dev/hd9var        262144    162588   38%     4566    12% /var
/dev/hd3          2097152   1626384   23%      214     1% /tmp
/dev/hd1           786432    785764    1%       27     1% /home
/proc                   -         -    -         -     -  /proc
/dev/hd10opt       131072     45776   66%     1711    14% /opt
/dev/informix_lv     3145728   1897000   40%     5255     2% /informix
/dev/setup_lv     4194304   3246572   23%      499     1% /setup
[p615:root:/home] fuser -dV /home
/home:
inode=4      size=15802        fd=1      364720
[p615:root:/home]


Last edited by zaxxon; 12-01-2009 at 07:32 AM.. Reason: code tags
# 4  
Old 11-27-2009
Finding filename given inode in AIX

Use "ncheck" to find a filename given an inode.

You will need to supply the inode and the filesystem that it came from.

If the file has been deleted - meaning ALL instances of it - then this command will not work as it uses filesystem directory entires to make the connection between a filename and the inode.

When you rm a file, you are actually un-linking it. This means that you are removing the directory entry and releasing the inode. So if you still have the file open, and it has been deleted (rm'ed) then it does not have a name (anymore).

Of course it is possible to have multiple (hard) links to a file - and therefore it would be possible to find a filename although it would not be the same as the deleted name. (name = full path to file).

The ncheck command (as well as other AIX info) can be found here:

AIX QuickStart
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Solaris

Retreive deleted file name if you having inode number

Some one please help me to find deleted file name, if I am having inode number in Solaris without using any 3rd party tool. Thanks :) (3 Replies)
Discussion started by: aksijain
3 Replies

2. Red Hat

Inode number changes for a file in Redhat Linux

Hi, I have created a file abc.log in Redhat Linux. Inode number for a file get changes every time i update the file using vi editor. Is there any setting that can be made , such that inode number never gets changed? Or if we cannot restrict from inode number getting changed , is... (9 Replies)
Discussion started by: raghu.amilineni
9 Replies

3. Shell Programming and Scripting

How can I get only FileName associated with a INODE on Unix much faster?

How can I get only FileName associated with a INODE on Unix in seconds instead of minutes, as it is the case for me as shown below. # Say I have FileDescriptor: 43, INODE: 2590784, File: abc.rdb. I want to get only filename associated with inode:2590784 and FD:43. $> time find / -inum... (7 Replies)
Discussion started by: kchinnam
7 Replies

4. UNIX for Dummies Questions & Answers

inode filename

can someone please tell me why is the filename not inlcuded in the inode of the file? (2 Replies)
Discussion started by: wowman
2 Replies

5. Filesystems, Disks and Memory

Recreating a deleted hardlink to a file if I know the inode number

At risk of twisting the rules to nearly the point of breaking (if you think this goes too far mods, I apologise and accept that this should be deleted), I'm hoping someone might be able to cast a little light on the following problem regarding hard links to files. ... (6 Replies)
Discussion started by: Smiling Dragon
6 Replies

6. UNIX for Dummies Questions & Answers

Number of Inode on a disk

How we can know number of inode present in my Disk including free and occupied. Is there any tool or program to know how much free inode are there in inode free list . (2 Replies)
Discussion started by: mr_deb
2 Replies

7. UNIX for Advanced & Expert Users

how to find out pathname from inode number

Hi all when I execute pmap command on one of my daemon process, I am able to see the following output. Address Kbytes RSS Anon Locked Mode Mapped File 00010000 40 40 - - r-x-- irs026bmd 00028000 56 56 16 - rwx-- irs026bmd 00036000... (3 Replies)
Discussion started by: axes
3 Replies

8. Filesystems, Disks and Memory

Inode number

as kernel keeps track of user activities on a file by its INODE number and I node table . what is the structure of Inode table. and where does this Inode table mapped into?user space or kernel space? is the Inode Number is fixed for a file till its deletion? thanks (1 Reply)
Discussion started by: compbug
1 Replies

9. UNIX for Dummies Questions & Answers

Directory Inode Number Not Unique

Hi, I know that inode for each file is unique, but is it the for the directory? So far I found different directories has the same inode nubmer when you do ls -i, could some one explain why? Thanks a lot. (9 Replies)
Discussion started by: nj302
9 Replies

10. Solaris

How to map a disk block to filename/ Inode

Hi, I want to find out a particular disk block belong to which file. in solaris 2.8 Can anyone help. Thanks and Regards Bala (1 Reply)
Discussion started by: Balamurugan
1 Replies
Login or Register to Ask a Question