0

When a file is saved into a drive, its contents are written & then indexed. I want to get the indexes and to access the raw contents of the files.

Any idea on the method how to do it, especially for ex4 & btrfs?

UPDATE: I want to get the addresses of the extents of a file. The information about the addresses must be stored somewhere onto the disk. I want to retrieve this info, in order to map the physical location of the file contents. Any methods in order to achieve that?

UPDATE: Hello, all! Thanks for your replies. What I want is a function/command which returns me a list of extent addresses. debugfs seems the function/command with the most-relevant functionality.

Yacov
  • 21
  • 2
  • What do you mean by "Indexed"? – the busybee Mar 27 '20 at 14:31
  • Excuse my poor terminology. I mean the addresses of the extents. – Yacov Mar 27 '20 at 15:10
  • 1
    There are lots of documentations on file systems available. They explain in detail how file contents is allocated on mass storage devices. What did you find by research, and which details gives you problems? – the busybee Mar 27 '20 at 17:44
  • But then I am trying to access internal data of the filesystem. I want to get the positions/addresses of all extents of a file - I want to map the storage consumption of the file. The nearest solution for me so far is debugfs, and meanwhile I haven't figured out how to use it .. . – Yacov Mar 27 '20 at 20:16

2 Answers2

0

It depends of the filesystem you are using. If you are running Linux you can use debufs to seek the file in the filesystem.

I have to say that all FSs are mounted through a VFS, a virtual filesystem that is like a simplified interface with the standard operations (open, close, read...). What is the meaning of that? No filesystem nor its contents(files, dirs) are opened directly from disk, when you open something, you move it to the main memory(your RAM) you do your operations and when you close something it returns to the disk drive.

Now, the question is: Can I get the absolute address in a FS? Yes, if you open your whole filesystem like open ("/dev/sdaX", 0_RDONLY); so you get the address relative to your filesystem using lseek in C for example.

And then... Can I get the same in the whole drive? No, that is because you cannot open the whole drive as a file descriptor. Remember /dev/sdaXin UNIX? Partitions and its can be opened like files because they have a virtual interface running on them.

Your last answer: Can I read really raw contents? All files are read as they appear on disk, the only thing that changes is the descriptor used by the OS and some data about how is indexed, all this as a "file header".

I hope all your questions are answered.

Blackburn
  • 48
  • 4
  • Thank you for your response! How can one use debugfs to retrieve the addresses of the extents of a file? Possible? – Yacov Mar 27 '20 at 15:25
0

The current solution/workaround is to call these functions with popen:

filefrag -e /path/to/file

hdparm --fibmap /path/to/filename

Then one should simply parse the stringoutputs of these programs. It is not a real solution (i.e.: outputs at C/C++ level), but I'll accept it for now.

Sources:

https://unix.stackexchange.com/questions/106802/what-command-do-i-use-to-see-the-start-and-end-block-of-a-file-in-the-file-syste

https://serverfault.com/questions/29886/how-do-i-list-a-files-data-blocks-on-linux

Yacov
  • 21
  • 2
  • This method works well with ext4. With BTRFS however filefrag returns garbage addresses (wildly inaccurate physical addresses). – Yacov Jun 13 '20 at 18:31