osx - Get file's block from inode on Mac -


in terminal, i'm able particular file's inode using stat command:

>> stat /some/file.txt 41307547 

but can't figure out how information file's data blocks (like address) this.

not sure if there's way native commands, did have luck using sleuthkit. once installed...

load disk image , partition actual files:

>> mls diskimage.dd          slot      start        end          length       description   000:  meta      0000000000   0000000000   0000000001   primary table (#0)   001:  -------   0000000000   0000000001   0000000002   unallocated   002:  000:000   0000000002   0003913663   0003913662   win95 fat32 (0x0b)   

the number 0000000002 offset files. using offset, can read list of files , inode values, if necessary:

>> fls -o 2 diskimage.dd    r/r 5:  ._.trashes   d/d * 6:    _rashe~1.nrv   d/d 8:  .trashes d/d 10: .fseventsd d/d 13: .spotlight-v100 r/r 16: somefile.txt 

finally, our partition offset , inode number, use istat list of sectors file:

>> istat -o 2 diskimage.dd 16  directory entry: 16 allocated file attributes: file, archive size: 158184 name: somefile.txt  directory entry times: written:    2015-10-26 15:57:04 (edt) accessed:   2015-11-01 00:00:00 (edt) created:    2015-10-20 20:37:17 (edt)  sectors: 1282198 1282199 1282200 1282201 1282202 1282203 1282204 1282205  1282206 1282207 1282208 1282209 1282210 1282211 1282212 1282213  1282214 1282215 1282216 1282217 1282218 1282219 1282220 1282221  1282222 1282223 1282224 1282225 1282226 1282227 1282228 1282229  1282230 1282231 1282232 1282233 1282234 1282235 1282236 1282237  1282238 1282239 1282240 1282241 1282242 1282243 1282244 1282245  1282246 1282247 1282248 1282249 1282250 1282251 1282252 1282253  1282254 1282255 1282256 1282257 1282258 1282259 1282260 1282261  1282262 1282263 1282264 1282265 1282266 1282267 1282268 1282269 ... 

Comments

Popular posts from this blog

javascript - Slick Slider width recalculation -

jsf - PrimeFaces Datatable - What is f:facet actually doing? -

angular2 services - Angular 2 RC 4 Http post not firing -