5

Assume you have a filename/directory name, whatever, which is hard linked to inode 6400. Alas, the file/directory actually exists (completely intact, and maybe it only lives in a single data block, for the sake of simplicity), but it has been marked as unallocated and moved to inode 3100.

Or maybe a file/directory has been removed with rm and there is no hard link to point to it, but I'd like to create one and mark the inode as allocated again.

Is there a tool available to do either of these things?

Bad answers to this question are anything involving really broad tools like fsck/e2fsck, and testdisk.

Good answers take the form of "try running awesomeln -r oldname.txt -n filename.txt -i 3100" or "No such tool exists, as far as I am aware, and I am aware of a lot of things because I've been working in digital forensics for ten years. Why don't you go write one?"

Jeff Schaller
  • 67,283
  • 35
  • 116
  • 255
Jade
  • 61
  • 1
    I have no idea if this is possible, but if you want to do some more research: I ran across an option configuring the kernel called CONFIG_FHANDLE (http://cateee.net/lkddb/web-lkddb/FHANDLE.html) which allows you to access files via file handle instead of through paths. A C call that looked interesting was open_by_handle_at(), mentioned at https://lwn.net/Articles/593072/. So if you could create the necessary parameters dictated by the function manually in C, you may be able to manipulate the file without a path. – vik Feb 23 '16 at 23:18
  • 3
    perhaps related (there are a couple answers there which might be helpful) – Liam Feb 23 '16 at 23:18
  • 1
    You mean you want to undelete a deleted file? – psusi Feb 23 '16 at 23:41
  • @Vik - that's not quite what I'm looking for but it's definitely a good place to start/ You should post that as an answer since it's the best one I've gotten so far. – Jade Feb 25 '16 at 07:20
  • @Liam - that bit about why flink() never became a thing explains a lot. It's a crying shame because I agree that Ulrich was really onto something there. That sort of thing is pretty much exactly what I'm looking for as standalone tool. I understand why it's insecure to implement it in the kernel. In a recovery environment where security is a moot point, this would be quite useful. – Jade Feb 25 '16 at 07:31

1 Answers1

4

If the inode isn't linked to any name and marked as free (number of links zero), it is free and liable to be reused at any time, this type of operation just makes no sense in this case. If it isn't marked as free (number of links not zero), the filesystem is corrupt, and fsck(8) is mandatory.

Some filesystems sport some form of "editor", mostly used for debugging (and people who find Russian roulette boring).

vonbrand
  • 18,253
  • 1
    See, this is exactly the kind of useless and unhelpful answer I pointed out in my original question. You shouldn't question WHY someone wants to do something. Just accept that they want to do it and help look for a means to do so or stay quiet.

    I think I should specify, just for those who have trouble thinking outside the box, that this theoretical task is to be done on a filesystem that exists in a vacuum, has only a root user, the data in the block is perfectly intact, is read-only, and magically becomes read-write the moment the inode is to be assigned a new hard link.

     – Jade Feb 24 '16 at 05:16
  • @JadeAndersen, sorry that the only answer to your question is "useless". But it just so happens often people get it in their mind they need to do something that makes no sense, or is just a completely misguided path to what they want to accomplished. Look for XY question. – vonbrand Feb 24 '16 at 09:46
  • Well, "no such tool exists" and possibly a supplemental "here is why" is useful. A suggestion to fsck is a bad answer because, as I stated before, this hypothetical problem takes place in a bubble where automated disk repair tools don't exist/don't perform the job they were meant to do. It's not really your job to go around judging why people want to do things that make no sense to you. At least the comments offered some decent answers to this mental exercise. – Jade Feb 24 '16 at 21:42
  • @JadeAndersen, such a "bubble" is severely broken, that is all. And throwing around imaginary scenarios is just wasting everybody's time. – vonbrand Feb 24 '16 at 21:47
  • It's not wasting my time. I'm learning, and I feel like that's the whole point of StackExchange. If it's a waste of your time, don't answer the question. I only got up the courage to make an account and ask after I read a post where a couple of people like you admonished someone else on here who accidentally sudo rm -f * everything in the wrong folder.

    I'm sure there are folks who have done what this poor fellow did, or had GParted crash on them during a partition adjustment, or lost power at a crucial time, or lots of things that could lead to a situation where such a tool may be useful.

     – Jade Feb 25 '16 at 06:53