filefrag
and debugfs
report offset expressed in number of filesystem blocks.
To get the offset in number of 512 byte units, you need to multiply by the size of the block in 512 byte units. On ext4 FS, block size is often 4k, so you need to multiply by 8.
With filefrag
, you can also use a -b 512
option to get the offset in 512 byte units.
You can get the block size with the stats
command in debugfs
, or with GNU stat:
stat -fc%s /mount/point
(or any file in that filesystem).
Note that hdparm
is a hard-disk utility, it will try to give the offset within the disk as opposed to the block device the file system is mounted on (assuming that block device does reside on disk somehow). It only works that way for partitions (by adding the content of /sys/class/block/the-block-device/start
to the actual offset), and md RAID 1 devices, but not other possibly disk backed block device types like device mapper devices, other RAID levels, dmraid devices, loop, nbd... Also note that older versions of hdparm
relied on the FIBMAP ioctl which is limited in what block device it can be use on, while newer versions use FIEMAP like filefrag
.
So, for instance, if you have an ext2
filesystem on /dev/sda1
.
# hdparm --fibmap /file/in/there
/file/in/there:
filesystem blocksize 1024, begins at LBA 2048; assuming 512 byte sectors.
byte_offset begin_LBA end_LBA sectors
0 109766 109767 2
You can get those two sectors (but note that the file likely uses only part of it):
dd skip=109766 count=2 if=/dev/sda # not /dev/sda1
While with filefrag
or debugfs.
# filefrag -v /file/in/there
Filesystem type is: ef53
Filesystem cylinder groups is approximately 12
File size of /file/in/there is 87 (1 block, blocksize 1024)
ext logical physical expected length flags
0 0 53859 1 merged,eof
You get it from the actual block device:
dd bs=1024 skip=53859 count=1 if=/dev/sda1
Inode 0 is used as a NULL value to indicate that there is no inode.
Inode 1 is used to keep track of any bad blocks on the disk; it is essentially a hidden file containing the bad blocks. Those bad blocks which are recorded using e2fsck -c
.
Inode 2 is used by the root directory, and indicates starting of filesystem inodes.
Best Answer
As we know, everything is a file in Linux even the directories. Also every file has an inode.
That said, a directory's inode has a map of it's contents (files and subdirectories) into blocks (a block is part of a inode structure), it can be described with the following image: