finding what files are stored in a specific physical range on disk
How do I find out what files are stored in a specific range on a specific physical disk? I have a 1.8 TiB partition, and I need to find out which of the files in it have any (some or all) of their data stored in the first 713,996 KiB of a particular partition.
Here's why I have to do that:
ek@Del:~$ lsb_release -a; uname -a; echo; mount | grep /dev/sdb; df -h | grep /dev/sdb; sudo fdisk -l /dev/sdb
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 11.04
Release: 11.04
Codename: natty
Linux Del 2.6.38-11-generic #50-Ubuntu SMP Mon Sep 12 21:18:14 UTC 2011 i686 i686 i386 GNU/Linux
/dev/sdb1 on /media/dAlembertian type ext4 (rw,commit=0)
/dev/sdb1 1.8T 1.4T 318G 82% /media/dAlembertian
Disk /dev/sdb: 2000.4 GB, 2000398934016 bytes
19 heads, 24 sectors/track, 8568046 cylinders
Units = cylinders of 456 * 512 = 233472 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x40004468
Device Boot Start End Blocks Id System
/dev/sdb1 * 1 3132 713996 17 Hidden HPFS/NTFS
I created this icky situation by accidentally writing a CD .iso image to the wrong device (actually, to the "right" device, but on the wrong computer--I failed to realize that I was SSHed into a different machine!). I terminated dd a couple of seconds after launching it, so it is unlikely that the entire ~700 MiB range was written--but unless there is an efficient way to find out how much was written (the dd command does not provide this information when it quits from SIGINT), I figured that I'd better assume that it was.
All the important data on the drive are backed up. But some are unimportant enough that I can live without them, but would prefer to have them. And more importantly, some of the backups would be very time-consuming to restore (for example, I would have to go and re-rip a number of DVD's and audio CD's, redownload various content, and so forth).
Since the partition with the old layout was still mounted[1], I went ahead and copied its entire contents to a separate 1.8 TiB drive. Now, even if I unmount /dev/sdb1 or reboot, I will still have the data readily accessible on that drive. But I fear that some of the data are probably corrupted, that is, that a number of files have had some of their data overwritten by the data written from the CD .iso image.
That is why I want to be able to get a list of files that have some or all of their data stored in the first 713,996 KiB of /dev/sdb1. Then I can just restore those files. That would be enormously easier and faster than attempting to restore all 1.4 TiB. Of course, if there is a way for me to narrow down the overwritten portion of the disk to less than 713,996 KiB and discover what files have some of their data in the smaller portion, that would be even better.
[1] In case this somewhat strange situation is better explained other than in my own words, here's the message that is printed out when gparted enumerates the partition table on /dev/sdb: "Partition(s) 1 on /dev/sdb have been written, but we have been unable to inform the kernel of the change, probably because it/they are in use. As a result, the old partition(s) will remain in use. You should reboot now before making further changes." Conveniently, the kernel still knows about / believes in the old partition table, so I was able to copy the data off it (sort of like cartoon characters not falling until they look down and see they have run off the edge of a cliff).
Question information
- Language:
- English Edit question
- Status:
- Solved
- Assignee:
- No assignee Edit question
- Solved by:
- Eliah Kagan
- Solved:
- Last query:
- Last reply: