Get physical location from file

spiri13 · 12-31-2016, 07:27 AM

Hi,

I want to get the physical location from an arbitrary file.

I sent the following command:

Code:

echo abc > f
filefrag -v f

I get the following output:

Code:

Filesystem type is: happynewyear
File size of f is 4 (1 block of 4096 bytes)
 ext:     logical_offset:        physical_offset: length:   expected: flags:
   0:        0..       0:   47906301..  47906301:      1:             last,eof
f: 1 extent found

Now I want to overwrite those four bytes directly using dd command. I know the physical offset (47906301). I know, the file is only holding one single sector (512 Bytes). But when I send the following command:

Code:

sudo dd seek=41978746 if=/dev/zero of=/dev/sda count=1 obs=1
cat f

Output is still "abc".

So either the physical location is not correct, or I do something wrong with dd. I think my problem is with dd command. So lemme explain my dd-invokation!

seek-option: "skip N obs-sized blocks at start of output"
-> So I want to skip 47906301 bytes. Because the default for an obs-sized block is 512 bytes, I set also obs=1 for an obs-sized block of one single byte.

count-option: only overwrite one single sector.

obs-option: set to one byte. see "seek-option" above.

What am I doing wrong?

Briefly: I want to get the physical location of a file and overwrite its content directly writing to /dev/sda.

luvr · 12-31-2016, 08:39 AM

Quote:

Originally Posted by spiri13

So I want to skip 47906301 bytes.

Not quite: You want to skip 47906301 blocks, not bytes.
Since the output from the filefrag command tells you that one block is 4096 bytes (and you set obs=1), you will have to seek to a position of:

Code:

seek=$(( 47906301 * 4096 ))

(BTW, your dd command has a seek position of 41978746, instead of 47906301. Probably just a typo?)

Quote:

Briefly: I want to get the physical location of a file and overwrite its content directly writing to /dev/sda.

No, you should definitely not write to /dev/sda (i.e., the whole disk), but to the partition instead (e.g., /dev/sda1, or /dev/sda2, or whatever).

If you really do want to write to the proper location on the whole disk, then you will have to add in the starting position of the partition—which you can find using the fdisk command:

Code:

fdisk -l /dev/sda

The "Units:" line in the output will tell you that the command will count sectors of 1 * 512 = 512 bytes. So, for instance, if your file is on the /dev/sda6 partition, and fdisk tells you that that partition begins at sector 302252032, then the correct position (relative to the whole disk) will become:

Code:

seek=$(( 302252032 * 512 + 47906301 * 4096 ))

By the way, overwriting some arbitrary position on your disk is pretty risky business, so you may want to double-check that you really are addressing the correct location by reading it first, e.g.:

Code:

sudo dd if=/dev/sda ibs=1 skip=$(( 302252032 * 512 + 47906301 * 4096 )) count=4 | hexdump -C

The output should look like the following:

Code:

4+0 records in
0+1 records out
4 bytes copied, 0.3293 s, 0.0 kB/s
00000000  61 62 63 0a                                       |abc.|
00000004

smallpond · 12-31-2016, 09:07 AM

Filesystem offsets are from the start of the block device on which the filesystem resides. This could be a disk, a disk partition, or a logical volume. Check the mount command.

spiri13 · 12-31-2016, 10:59 AM

Thank you, I successfully located the position of the file.

Have a happy new year!

Jjanel · 01-01-2017, 06:15 AM

cool! (I love learning 'deep' stuff like this too

)
Feel free to mark thread as '[SOLVED]' (via ThreadTools at top)
esp. so future searchers will see there's a solution here!
Best wishes...