11-27-2009
Finding filename given inode in AIX
Use "ncheck" to find a filename given an inode.
You will need to supply the inode and the filesystem that it came from.
If the file has been deleted - meaning ALL instances of it - then this command will not work as it uses filesystem directory entires to make the connection between a filename and the inode.
When you rm a file, you are actually un-linking it. This means that you are removing the directory entry and releasing the inode. So if you still have the file open, and it has been deleted (rm'ed) then it does not have a name (anymore).
Of course it is possible to have multiple (hard) links to a file - and therefore it would be possible to find a filename although it would not be the same as the deleted name. (name = full path to file).
The ncheck command (as well as other AIX info) can be found here:
AIX QuickStart
10 More Discussions You Might Find Interesting
1. Solaris
Hi,
I want to find out a particular disk block belong to which file. in solaris 2.8
Can anyone help.
Thanks and Regards
Bala (1 Reply)
Discussion started by: Balamurugan
1 Replies
2. UNIX for Dummies Questions & Answers
Hi, I know that inode for each file is unique, but is it the for the directory? So far I found different directories has the same inode nubmer when you do ls -i, could some one explain why? Thanks a lot. (9 Replies)
Discussion started by: nj302
9 Replies
3. Filesystems, Disks and Memory
as kernel keeps track of user activities on a file by its INODE number and I node table .
what is the structure of Inode table. and where does this Inode table mapped into?user space or kernel space?
is the Inode Number is fixed for a file till its deletion?
thanks (1 Reply)
Discussion started by: compbug
1 Replies
4. UNIX for Advanced & Expert Users
Hi all
when I execute pmap command on one of my daemon process, I am able to see the following output.
Address Kbytes RSS Anon Locked Mode Mapped File
00010000 40 40 - - r-x-- irs026bmd
00028000 56 56 16 - rwx-- irs026bmd
00036000... (3 Replies)
Discussion started by: axes
3 Replies
5. UNIX for Dummies Questions & Answers
How we can know number of inode present in my Disk including free and occupied.
Is there any tool or program to know how much free inode are there in inode free list . (2 Replies)
Discussion started by: mr_deb
2 Replies
6. Filesystems, Disks and Memory
At risk of twisting the rules to nearly the point of breaking (if you think this goes too far mods, I apologise and accept that this should be deleted), I'm hoping someone might be able to cast a little light on the following problem regarding hard links to files.
... (6 Replies)
Discussion started by: Smiling Dragon
6 Replies
7. UNIX for Dummies Questions & Answers
can someone please tell me why is the filename not inlcuded in the inode of the file? (2 Replies)
Discussion started by: wowman
2 Replies
8. Shell Programming and Scripting
How can I get only FileName associated with a INODE on Unix in seconds instead of minutes, as it is the case for me as shown below.
# Say I have FileDescriptor: 43, INODE: 2590784, File: abc.rdb. I want to get only filename associated with inode:2590784 and FD:43.
$> time find / -inum... (7 Replies)
Discussion started by: kchinnam
7 Replies
9. Red Hat
Hi,
I have created a file abc.log in Redhat Linux.
Inode number for a file get changes every time i update the file using vi editor.
Is there any setting that can be made , such that inode number never gets changed?
Or if we cannot restrict from inode number getting changed , is... (9 Replies)
Discussion started by: raghu.amilineni
9 Replies
10. Solaris
Some one please help me to find deleted file name, if I am having inode number in Solaris without using any 3rd party tool.
Thanks :) (3 Replies)
Discussion started by: aksijain
3 Replies
LEARN ABOUT DEBIAN
extundelete
EXTUNDELETE(1) General Commands Manual EXTUNDELETE(1)
NAME
extundelete - utility to undelete files from an ext3 or ext4 partition.
SYNOPSIS
extundelete [options] device-file...
DESCRIPTION
extundelete is a utility that can recover deleted files from an ext3 or ext4 partition
extundelete uses the information stored in the partition's journal to attempt to recover a file that has been deleted from the partition.
There is no guarantee that any particular file will be able to be undeleted, so always try to have a good backup system in place, or at
least put one in place after recovering your files!
OPTIONS
--version
Prints the version number of extundelete.
--help Print a brief usage summary for extundelete.
Partition name
Name of the partition that has deleted files, such as /dev/sda3.
Could also be the file name of a copy of the partition, such as that made with dd.
--superblock
Prints information about the filesystem from the superblock.
--journal --superblock
Prints information about the journal from the journal's superblock.
--inode #
Prints the information from the inode number of the filesystem given, such as "--inode 2".
--block #
Prints the contents of the block, called as "--block 9652".
--restore-file path/to/deleted/file
Attempts to restore the file which was deleted at the given filename, called as "--restore-file dirname/filename".
--restore-inode #
Used to restore inodes by number, called as "--restore-inode 2569".
Also accepts a list of inodes separated by only commas, such as "--restore-inode 2569,5692,6925".
--restore-files filename
Restores a list of files. First, construct a list of files in the same style as would be
used in the --restore-file option, and save it to the file "filename".
Then, this option may be used to attempt to restore those files with a single call to extundelete.
This form also reduces redundancy from multiple calls parsing the journal multiple times.
--output-dir path/to/dump/recovered/files
Restores files in the output dir 'path'.
By default the restored files are created under current directory 'RECOVERED_FILES'
--restore-all
Restores all files possible to undelete to their names before deletion, when possible. Other files are restored to a filename like
"file.NNNN".
--restore-directory path/of/directory
Restores all files possible to link to specified directory to their names before deletion, when possible.
-j journal_dev
Specifies the device that is the external journal of the file system.
-b block_number
Specifies the block number of the backup superblock to be used when opening the file system.
-B block_size
Specifies the block size of the partition to be used when opening the file system.
--before date
Only restore files deleted before the date specified, which should be in the form of the number of seconds since the UNIX epoch.
Use a shell command like
$ date -d "Aug 1 9:02" +%s
to convert a human-readable date to the proper format. The conversion from the number of seconds to a readable format may be found
by using either of the following:
$ date -d@1234567890
$ perl -le "print scalar localtime 1234567890"
--after date
Only restore files deleted after the date specified, which should be in the form of the number of seconds since the UNIX epoch.
See the notes for the --before option for more information.
AUTHOR
extundelete was written by Nic Case <number9652@users.sourceforge.net> Copyright (C) 2009, 2010
This manual page was written by Elias Alejandro Ano Mendoza <ealmdz@gmail.com>, for the Debian project (and may be used by others).
September 29, 2010 EXTUNDELETE(1)