Tool to create a hard link to an unlinked inode

data-recoverydirectoryhard linkinoderm

Assume you have a filename/directory name, whatever, which is hard linked to inode 6400. Alas, the file/directory actually exists (completely intact, and maybe it only lives in a single data block, for the sake of simplicity), but it has been marked as unallocated and moved to inode 3100.

Or maybe a file/directory has been removed with rm and there is no hard link to point to it, but I'd like to create one and mark the inode as allocated again.

Is there a tool available to do either of these things?

Bad answers to this question are anything involving really broad tools like fsck/e2fsck, and testdisk.

Good answers take the form of "try running awesomeln -r oldname.txt -n filename.txt -i 3100" or "No such tool exists, as far as I am aware, and I am aware of a lot of things because I've been working in digital forensics for ten years. Why don't you go write one?"

Best Answer

If the inode isn't linked to any name and marked as free (number of links zero), it is free and liable to be reused at any time, this type of operation just makes no sense in this case. If it isn't marked as free (number of links not zero), the filesystem is corrupt, and fsck(8) is mandatory.

Some filesystems sport some form of "editor", mostly used for debugging (and people who find Russian roulette boring).

Related Question