ffind
from The Sleuth Kit can find all the file names for an inode, including deleted file names.
For example:
sudo ffind -a /dev/sda3 $(stat --format=%i ~/just_a_test)
yields
* /home/me/empty_1
* /home/me/hard_link_to_empty1
/home/me/just_a_test
/home/me/hard_link_to_just_a_test
The entries with a preceding star are previous file names that don't exist anymore (because the file was renamed or deleted).
I use $(stat --format=%i ~/just_a_test)
to get the inode of the file.
To get the partition of the file name programmatically (/dev/sda3
in the previous example), you can use df
:
file=~/just_a_test; sudo ffind -a $(df -P "$file" | awk 'END{print $1}') $(stat --format=%i "$file")