Closed maltfield closed 3 years ago
When running TestDisk, choose to create a log file, in Advanced, list the files. The inode number is recorded in the log file. Example:
Directory /
2 dr-xr-xr-x 0 0 4096 15-Sep-2020 21:10 .
2 dr-xr-xr-x 0 0 4096 15-Sep-2020 21:10 ..
11 drwx------ 0 0 16384 15-Jan-2014 08:25 lost+found
12 drwxr-xr-x 0 0 4096 8-May-2018 13:35 efi
13 drwx------ 0 0 4096 11-Aug-2020 01:41 grub2
14 -rwxr-xr-x 0 0 11655344 9-Sep-2020 21:44 vmlinuz-5.8.8-200.fc32.x86_64
...
51 -rw------- 0 0 33206265 11-Sep-2020 08:13 initramfs-5.8.7-200.fc32.x86_64.img
X 51 -rw------- 0 0 33206265 11-Sep-2020 08:13 initramfs-5.7.17-200.fc32.x86_64.img
X 57 -rw------- 0 0 0 7-May-2020 07:51 initramfs-5.3.13-300.fc31.x86_64.img
X 43 -rw-r--r-- 0 0 249 9-Sep-2020 21:44 initramfs-4.20.14-200.fc29.x86_64.img
Feature Request: Please add the ability to print the location on disk where a deleted file's bytes lived/live.
Why?
Consider the case where a user accidentally
rm
'd a file when they actually meant to securely delete it (withsrm
orshred
, for example).Testdisk can help find that file, but currently it can only restore it (which, in this case, would actually make the issue worse since it may not be restored to the same physical location on-disk).
But if
testdisk
had a way to simply print the location where the file used to live on-disk, then a user would be able to take this information to another tool and securely overwrite the disk where a deleted file was insecurely deleted.See Also