08-11-2008
I don't think that you're breaking the rules with a 2 week bump. Hard links are only possible within a file system. You can't can't make a hard link from one file system into another file system. /proc is a separate file system and you can't create links there at all. An extra link in /proc won't help you anyway. Forget /proc. It goes nowhere.
The only tool with a shot at this is fsdb, but I don't know fsdb well enough to tell you the precise steps. Call this plan A. The general steps I would try are:
1 create some file
2 create an extra link to the file with very bizarre name (more easily found and easy to sure you have the right one)
3 hit the power switch to drop power to the box
4 come up in single user mode and run fsdb
5 edit the directory entry to point to my file
6 edit the inodes to increment and decrement the usuage counts
7 run fsck
And I would practice on a test system before I tried it for real.
If I couldn't get it to work, plan B:
1 drop power
2 ship the disk to a data recovery specialist with experts who can implement plan A.
10 More Discussions You Might Find Interesting
1. Filesystems, Disks and Memory
as kernel keeps track of user activities on a file by its INODE number and I node table .
what is the structure of Inode table. and where does this Inode table mapped into?user space or kernel space?
is the Inode Number is fixed for a file till its deletion?
thanks (1 Reply)
Discussion started by: compbug
1 Replies
2. Solaris
I'm trying to relink a file someone tried to delete while a process (that we don't want to shutdown) also had a filehandle open to it.
Consequently, we've got an inode entry but no directory entry (aka 'file') for it.
I've tracked the inode number down via lsof, as well as the particular... (0 Replies)
Discussion started by: Smiling Dragon
0 Replies
3. UNIX for Dummies Questions & Answers
How we can know number of inode present in my Disk including free and occupied.
Is there any tool or program to know how much free inode are there in inode free list . (2 Replies)
Discussion started by: mr_deb
2 Replies
4. Solaris
Folks,
just wondering if there is a way to recreate this file if inadvertantly removed ?? (8 Replies)
Discussion started by: trevagreene
8 Replies
5. AIX
How to get the filename of which has been deleted if I know the inode number.
i can use the command "istat" to get the inode number of the file.
# istat
/proc//fd/x
If this file has been deleted,but the process of this file has not been closed and handle has not been released ,so this... (3 Replies)
Discussion started by: JoyOnLine
3 Replies
6. Shell Programming and Scripting
Hi all,
I am struggling to change the content of a file without changing the inode number. The exact issue is as below.
I have a file name test.bak which has 100 lines of text.
I am trying to to delete the first 90 lines of the text in the file.
I know that using sed/awk/head/tail I can... (3 Replies)
Discussion started by: sathishkmrv
3 Replies
7. Red Hat
Hi,
I have created a file abc.log in Redhat Linux.
Inode number for a file get changes every time i update the file using vi editor.
Is there any setting that can be made , such that inode number never gets changed?
Or if we cannot restrict from inode number getting changed , is... (9 Replies)
Discussion started by: raghu.amilineni
9 Replies
8. Solaris
Some one please help me to find deleted file name, if I am having inode number in Solaris without using any 3rd party tool.
Thanks :) (3 Replies)
Discussion started by: aksijain
3 Replies
9. Shell Programming and Scripting
is it possible to change the inode value/ file path of a hard link? (2 Replies)
Discussion started by: fhill2
2 Replies
10. Linux
Hi,
I have created a file a.txt in Redhat Linux.
Inode number for a file changes every time i update the file using vi editor , gedit etc.
Is there any setting that can be made , such that inode number never changes as that is supposed to be the expected behavior?
Or if we cannot... (13 Replies)
Discussion started by: srirammanohar
13 Replies
FFIND(1) General Commands Manual FFIND(1)
NAME
ffind - Finds the name of the file or directory using a given inode
SYNOPSIS
ffind [-aduvV] [-f fstype] [-i imgtype] [-o imgoffset] [-b dev_sector_size] image inode
DESCRIPTION
ffind finds the names of files or directories that are allocated to inode on disk image image. By default it only will only return the
first name it finds. With some file systems, this will find deleted file names.
ARGUMENTS
image [images]
One (or more if split) disk or partition images whose format is given with '-i'.
inode Integer of inode to find.
The optional arguments are:
-a Find all occurrences of inode.
-d Find deleted entries only.
-f fstype
Identify the file system type of the image. Use '-f list' to list the supported file system types. If not given, autodetection
methods are used.
-u Find undeleted entries only.
-i imgtype
Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection
methods are used.
-o imgoffset
The sector offset where the file system starts in the image.
-b dev_sector_size
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or
512-bytes is assumed.
-v Verbose output to stderr.
-V Display version.
This program searches all directory entries looking for the given inode. This is useful when an inode has been identified from a disk unit
address using ifind(1).
EXAMPLE
# ffind -a image 212
SEE ALSO
ifind(1)
AUTHOR
Brian Carrier <carrier at sleuthkit dot org>
Send documentation updates to <doc-updates at sleuthkit dot org>
FFIND(1)