LinuxQuestions.org - [SOLVED] Extracting file information from Inode number

- Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)

- - Extracting file information from Inode number (https://www.linuxquestions.org/questions/linux-newbie-8/extracting-file-information-from-inode-number-4175452933/)

Extracting file information from Inode number

Hi All,

I was wondering if there is any way by which we can extract the file information from inode number, like permissions,ownership,mtime etc. Forexample if i have an inode number such as 4462, then how do i read this inode number to know what all information it has.

you can use stat command but i dont think it shows information by inode number for input.
you can change inode number to file adress by using find command like this :

Code:

# find -inum 1441793 -exec stat {} \;

1441793 = Inode number
-exec = run command on files that matched.

Try:

Code:

~$ find -inum 4462 -exec ls -la {} \;

Perhaps debugfs is what you are thinking of:

http://superuser.com/questions/39010...-fsdb-in-linux

It can examine any ext based filesystem and identify files by inode. Note: it is STRONGLY recommended that this only be used on a dismounted filesystem. It may even require that before it will run.

Quote:

Originally Posted by jpollard (Post 4906226)

Perhaps debugfs is what you are thinking of:

Note: it is STRONGLY recommended that this only be used on a dismounted filesystem. It may even require that before it will run.

There is no danger in running debugfs in its default read-only mode on a mounted filesystem. You do have to be aware that information about currently open or very recently modified files might not be up to date. And, debugfs is quite happy to let you shoot yourself in the foot by running in read/write mode and making changes to a currently mounted filesystem. As the manpage says, "debugfs is a debugging tool. It has rough edges!"

Quote:

Originally Posted by rknichols (Post 4906244)

running in read/write mode and making changes to a currently mounted filesystem

Useful for doing chmod on a directory otherwise inaccessible because it is the mount point for another filesystem that you cannot unmount to do chmod conventionally.

Quote:

Originally Posted by linosaurusroot (Post 4906278)

Useful for doing chmod on a directory otherwise inaccessible because it is the mount point for another filesystem that you cannot unmount to do chmod conventionally.

As long as it isn't cached due to open files...

Quote:

Originally Posted by linosaurusroot (Post 4906278)

Useful for doing chmod on a directory otherwise inaccessible because it is the mount point for another filesystem that you cannot unmount to do chmod conventionally.

You don't need to use debugging tools for that. You can use a "bind mount" to look at parts of a filesystem that are hidden under an active mount point. For example, I have a separate partition mounted on /var:

Code:

# df /var

Filesystem          1K-blocks      Used Available Use% Mounted on

/dev/sda6            33032196  5738480  25615732  19% /var

If I want to see what, if anything, is in the root filesystem's /var directory hidden under that mount:

Code:

# mount --bind / /mnt/tmp

# df /mnt/tmp/var

Filesystem          1K-blocks      Used Available Use% Mounted on

/dev/sda2              1555676    629752    846820  43% /

# ls -laR /mnt/tmp/var

/mnt/tmp/var:

total 16

drwxr-xr-x.  3 root root 4096 2009-12-17 18:50 .

dr-xr-xr-x. 26 root root 4096 2013-03-03 11:20 ..

drwxr-xr-x.  3 root root 4096 2009-12-17 18:50 lib



/mnt/tmp/var/lib:

total 12

drwxr-xr-x. 3 root root 4096 2009-12-17 18:50 .

drwxr-xr-x. 3 root root 4096 2009-12-17 18:50 ..

drwxr-xr-x. 2 root root 4096 2009-12-17 18:50 rpm



/mnt/tmp/var/lib/rpm:

total 900

drwxr-xr-x. 2 root root    4096 2009-12-17 18:50 .

drwxr-xr-x. 3 root root    4096 2009-12-17 18:50 ..

-rw-r--r--. 1 root root  12288 2009-12-17 18:50 Name

-rw-r--r--. 1 root root  12288 2009-12-17 18:50 Packages

-rw-r--r--. 1 root root  24576 2009-12-17 18:50 __db.001

-rw-r--r--. 1 root root  237568 2009-12-17 18:50 __db.002

-rw-r--r--. 1 root root 1318912 2009-12-17 18:50 __db.003

-rw-r--r--. 1 root root  753664 2009-12-17 18:50 __db.004

Oops! Looks like I've got some junk there that doesn't belong. Let's get rid of it.

Code:

# rm -r /mnt/tmp/var/lib

# ls -laR /mnt/tmp/var

/mnt/tmp/var:

total 12

drwxr-xr-x.  2 root root 4096 2013-03-06 18:41 .

dr-xr-xr-x. 26 root root 4096 2013-03-03 11:20 ..

# df /mnt/tmp/var

Filesystem          1K-blocks      Used Available Use% Mounted on

/dev/sda2              1555676    628852    847720  43% /

Leftover RPM database removed. Space on root filesystem has been recovered.

Code:

# umount /mnt/tmp

Let's not forget that.

I appreciate all your responses, but I think my question has been little misunderstood. I know how to find and see Inode number what i wanted to know is how i can know file information just by looking at the inode number. I mean i have reading this since i started learning linux that inode number contains 6-7 types of information it few to name like file permissions, information about file owner and when file was accessed/modified. So is it possible if i have a inode number and by just looking at it i can determine file infomation.

Inode number contains all info, including file type, size, location of the file, owner, group etc, except filename itself.

Therefore, in case, if you only need info. about file attributes, then ls cmd and it's associated options will do that.

Code:

~$ ls -l filename

~$ man ls

Just check it's manual here.

OR, to find a file on basis of it's inode number, and display file attributes, use:

Code:

~$ find -inum 4462 -exec ls -la {} \;

Quote:

Originally Posted by shivaa (Post 4907261)

Code:

~$ ls -l filename

~$ man ls

Just check it's manual here.

OR, to find a file on basis of it's inode number, and display file attributes, use:

Code:

~$ find -inum 4462 -exec ls -la {} \;

I obviously know about ls and find :) . However i was looking for something else. Anyways thanks for all your responses and efforts, really appreciate.

Quote:

Originally Posted by Rohit_4739 (Post 4907293)

I obviously know about ls and find :) . However i was looking for something else.

Then you can let us know what 'something else' you're looking for? Be little more specific, then we might help you further.

Also you get file type using file cmd:

Code:

~$ file <filename>

I THINK the op wants something like an "openi", which opens a file by the inode number; or a "stati", which would retrieve metadata based on the inode number.

These don't exist in Linux, partly for security reasons, partly because they don't provide any real advantage.

Security wise - it totally breaks GRS which only protects pathnames. It can also bypass user protection - if a user has 700 access mode on his home directory, but files within have 755 (happens a lot), then opening a file by inode bypasses the protection offered by the home directory.

Usefulness - The only system I've seen these system calls was UNICOS... and they were specifically implemented to optimize NFS access. In UNICOS the nfsd services for file access ran in user mode, as the owner of the file (nfsd had additional multi-level security definitions that prevented that user from causing a DOS by aborting the daemons). Since NFS file access is via "handles" which didn't carry file names (a SLOW way to access a file to read a block) - these handles used an inode cached as part of the local handle. Using openi and stati was used to bypass the relatively slow namei lookup in the kernel. Sinc nfsd runs in user mode, it had no choice other than to have a special purpose system call for fast access.

Linux has the NFS servers running in kernel mode to eliminate the DOS possibility. This also means the nfsd task has access to inode lookups without having to go through a namei lookup. So these calls don't provide any real benefit.