LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 12-31-2016, 08:27 AM   #1
spiri13
Member
 
Registered: Jun 2016
Posts: 57

Rep: Reputation: Disabled
Get physical location from file


Hi,

I want to get the physical location from an arbitrary file.

I sent the following command:

Code:
echo abc > f
filefrag -v f
I get the following output:

Code:
Filesystem type is: happynewyear
File size of f is 4 (1 block of 4096 bytes)
 ext:     logical_offset:        physical_offset: length:   expected: flags:
   0:        0..       0:   47906301..  47906301:      1:             last,eof
f: 1 extent found
Now I want to overwrite those four bytes directly using dd command. I know the physical offset (47906301). I know, the file is only holding one single sector (512 Bytes). But when I send the following command:

Code:
sudo dd seek=41978746 if=/dev/zero of=/dev/sda count=1 obs=1
cat f
Output is still "abc".

So either the physical location is not correct, or I do something wrong with dd. I think my problem is with dd command. So lemme explain my dd-invokation!

seek-option: "skip N obs-sized blocks at start of output"
-> So I want to skip 47906301 bytes. Because the default for an obs-sized block is 512 bytes, I set also obs=1 for an obs-sized block of one single byte.

count-option: only overwrite one single sector.

obs-option: set to one byte. see "seek-option" above.

What am I doing wrong?

Briefly: I want to get the physical location of a file and overwrite its content directly writing to /dev/sda.
 
Old 12-31-2016, 09:39 AM   #2
luvr
Member
 
Registered: May 2005
Location: Boom - The Home Town of Tomorrowland, Belgium
Distribution: Slackware, Debian, Xubuntu
Posts: 192
Blog Entries: 1

Rep: Reputation: 83
Quote:
Originally Posted by spiri13 View Post
So I want to skip 47906301 bytes.
Not quite: You want to skip 47906301 blocks, not bytes.
Since the output from the filefrag command tells you that one block is 4096 bytes (and you set obs=1), you will have to seek to a position of:
Code:
seek=$(( 47906301 * 4096 ))
(BTW, your dd command has a seek position of 41978746, instead of 47906301. Probably just a typo?)

Quote:
Briefly: I want to get the physical location of a file and overwrite its content directly writing to /dev/sda.
No, you should definitely not write to /dev/sda (i.e., the whole disk), but to the partition instead (e.g., /dev/sda1, or /dev/sda2, or whatever).

If you really do want to write to the proper location on the whole disk, then you will have to add in the starting position of the partition—which you can find using the fdisk command:
Code:
fdisk -l /dev/sda
The "Units:" line in the output will tell you that the command will count sectors of 1 * 512 = 512 bytes. So, for instance, if your file is on the /dev/sda6 partition, and fdisk tells you that that partition begins at sector 302252032, then the correct position (relative to the whole disk) will become:
Code:
seek=$(( 302252032 * 512 + 47906301 * 4096 ))
By the way, overwriting some arbitrary position on your disk is pretty risky business, so you may want to double-check that you really are addressing the correct location by reading it first, e.g.:
Code:
sudo dd if=/dev/sda ibs=1 skip=$(( 302252032 * 512 + 47906301 * 4096 )) count=4 | hexdump -C
The output should look like the following:
Code:
4+0 records in
0+1 records out
4 bytes copied, 0.3293 s, 0.0 kB/s
00000000  61 62 63 0a                                       |abc.|
00000004

Last edited by luvr; 12-31-2016 at 09:41 AM.
 
1 members found this post helpful.
Old 12-31-2016, 10:07 AM   #3
smallpond
Senior Member
 
Registered: Feb 2011
Location: Massachusetts, USA
Distribution: CentOS 6 & 7
Posts: 3,025

Rep: Reputation: 806Reputation: 806Reputation: 806Reputation: 806Reputation: 806Reputation: 806Reputation: 806
Filesystem offsets are from the start of the block device on which the filesystem resides. This could be a disk, a disk partition, or a logical volume. Check the mount command.
 
Old 12-31-2016, 11:59 AM   #4
spiri13
Member
 
Registered: Jun 2016
Posts: 57

Original Poster
Rep: Reputation: Disabled
Thank you, I successfully located the position of the file.

Have a happy new year!
 
Old 01-01-2017, 07:15 AM   #5
Jjanel
Member
 
Registered: Jun 2016
Distribution: any&all, in VBox; Ol'UnixCLI; NO GUI resources
Posts: 999
Blog Entries: 12

Rep: Reputation: 360Reputation: 360Reputation: 360Reputation: 360
cool! (I love learning 'deep' stuff like this too )
Feel free to mark thread as '[SOLVED]' (via ThreadTools at top)
esp. so future searchers will see there's a solution here!
Best wishes...
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
How can I determine the physical location of a download mirror? worm5252 Linux - Newbie 8 01-28-2010 11:27 PM
How to find physical location of a file on the HDD? CJS Linux - General 2 01-18-2009 11:14 AM
Logical disks and physical location on Sparc dazdaz Solaris / OpenSolaris 2 09-11-2007 10:52 AM
WHat is the physical path or location of the trash folder? ImOk Linux - Software 3 10-23-2006 01:39 PM
Changing physical location of directories Linus VanPelt Mandriva 2 02-23-2004 08:42 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 09:30 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration