How to get the filename of which has been deleted if I know the inode number.
i can use the command "istat" to get the inode number of the file.
# istat
/proc/[pid]/fd/x
If this file has been deleted,but the process of this file has not been closed and handle has not been released ,so this file has not been released yet.
then ,how can i get the path of which it has been deleted before if i know the inode number in AIX?
Thank you very much!
If the file is open, would "lsof" help? You could list all files opened by the process.
i have tried both in AIX and LINUX.
I can't get the path by using "lsof" in AIX,but it works well in LINUX.
Thank you Garethr!
---------- Post updated at 07:08 PM ---------- Previous update was at 05:44 PM ----------
I make a test here.
the file "test" under /home is deleted when it runs on "nohup".
because of the handle of "test" is not released so taht The space of /home is not released after deleted "test".
IF ADMINISTRATOR DOESN'T KNOW WHO REMOVED THE "test" AND WHAT THE REMOVED FILENAME IS,HE JUST CAN INPUT"fuser -dV /home" AND GET an INODE NUMBER,HOW CAN HE GET THIS FILENAME "test".
thankyou!
[p615:root:/home] df -k
Filesystem 1024-blocks Free %Used Iused %Iused Mounted on
/dev/hd4 5242880 4250220 19% 5537 1% /
/dev/hd2 2162688 64712 98% 44752 71% /usr
/dev/hd9var 262144 162600 38% 4566 12% /var
/dev/hd3 2097152 1626384 23% 214 1% /tmp
/dev/hd1 786432 785776 1% 26 1% /home
/proc - - - - - /proc
/dev/hd10opt 131072 45776 66% 1711 14% /opt
/dev/informix_lv 3145728 1897000 40% 5255 2% /informix
/dev/setup_lv 4194304 3246572 23% 499 1% /setup
[p615:root:/home] nohup vmstat 1 10000 > test &
[2] 364720
[p615:root:/home] df -k
Filesystem 1024-blocks Free %Used Iused %Iused Mounted on
/dev/hd4 5242880 4250220 19% 5537 1% /
/dev/hd2 2162688 64712 98% 44752 71% /usr
/dev/hd9var 262144 162600 38% 4566 12% /var
/dev/hd3 2097152 1626384 23% 214 1% /tmp
/dev/hd1 786432 785772 1% 27 1% /home
/proc - - - - - /proc
/dev/hd10opt 131072 45776 66% 1711 14% /opt
/dev/informix_lv 3145728 1897000 40% 5255 2% /informix
/dev/setup_lv 4194304 3246572 23% 499 1% /setup
[p615:root:/home] rm test
[p615:root:/home] df -k
Filesystem 1024-blocks Free %Used Iused %Iused Mounted on
/dev/hd4 5242880 4250220 19% 5537 1% /
/dev/hd2 2162688 64712 98% 44752 71% /usr
/dev/hd9var 262144 162600 38% 4566 12% /var
/dev/hd3 2097152 1626384 23% 214 1% /tmp
/dev/hd1 786432 785772 1% 27 1% /home
/proc - - - - - /proc
/dev/hd10opt 131072 45776 66% 1711 14% /opt
/dev/informix_lv 3145728 1897000 40% 5255 2% /informix
/dev/setup_lv 4194304 3246572 23% 499 1% /setup
[p615:root:/home] fuser -dV /home
/home:
inode=4 size=3040 fd=1 364720
[p615:root:/home] istat 4 /home
Inode 4 on device 10/8 Unallocated Inode
Owner: 0(root) Group: 0(system)
Link count: 0 Length 1086 bytes
Last updated: Wed Nov 25 17:56:49 BEIST 2009
Last modified: Wed Nov 25 17:56:49 BEIST 2009
Last accessed: Wed Nov 25 17:56:32 BEIST 2009
Block pointers (hexadecimal):
22
[p615:root:/home] istat 4 /dev/hd1
Inode 4 on device 10/8 Unallocated Inode
Owner: 0(root) Group: 0(system)
Link count: 0 Length 1086 bytes
Last updated: Wed Nov 25 17:56:49 BEIST 2009
Last modified: Wed Nov 25 17:56:49 BEIST 2009
Last accessed: Wed Nov 25 17:56:32 BEIST 2009
Block pointers (hexadecimal):
22
[p615:root:/home] df -k
Filesystem 1024-blocks Free %Used Iused %Iused Mounted on
/dev/hd4 5242880 4250220 19% 5537 1% /
/dev/hd2 2162688 64712 98% 44752 71% /usr
/dev/hd9var 262144 162588 38% 4566 12% /var
/dev/hd3 2097152 1626384 23% 214 1% /tmp
/dev/hd1 786432 785764 1% 27 1% /home
/proc - - - - - /proc
/dev/hd10opt 131072 45776 66% 1711 14% /opt
/dev/informix_lv 3145728 1897000 40% 5255 2% /informix
/dev/setup_lv 4194304 3246572 23% 499 1% /setup
[p615:root:/home] fuser -dV /home
/home:
inode=4 size=15802 fd=1 364720
[p615:root:/home]
Use "ncheck" to find a filename given an inode.
You will need to supply the inode and the filesystem that it came from.
If the file has been deleted - meaning ALL instances of it - then this command will not work as it uses filesystem directory entires to make the connection between a filename and the inode.
When you rm a file, you are actually un-linking it. This means that you are removing the directory entry and releasing the inode. So if you still have the file open, and it has been deleted (rm'ed) then it does not have a name (anymore).
Of course it is possible to have multiple (hard) links to a file - and therefore it would be possible to find a filename although it would not be the same as the deleted name. (name = full path to file).
The ncheck command (as well as other AIX info) can be found here: