There have been multiple accounts created with the sole purpose of posting advertisement posts or replies containing unsolicited advertising.

Accounts which solely post advertisements, or persistently post them may be terminated.

FOUND file in device by hex content using wxHexEditor

Just having a play around, this turned out to be not as clear cut as expected.

so I created a file and entered some text, used xxd to get the hex values, and then opened the device /dev/sdb1 in wxhexeditor and tried to find my file, but it’s not finding it. Inode is 19, so it should be right at the start of the first block group, but after several minutes, no joy. (drive is ext4.)

I thought this was going to be an easy task, just multiply the inode by the block size, open the device with wxhexeditor, and scroll to the line corresponding to the calculated byte, copy out the hex values and convert to ascii and voila, there’s the ‘hello world’… except no.

What am I missing here? Drive isn’t encrypted, nothing silly like that.

Ok, I managed to do it with dd:


<span style="color:#323232;">sudo dd if=/dev/sdb1 bs=8M skip=$((4660742*4096)) iflag=skip_bytes | head -c 4096
</span><span style="color:#323232;">
</span><span style="color:#323232;">hello
</span>

but why can I not find it using wxhexeditor??

EDIT:

Duh, I didn’t click that offset needed to be multiplied by the block size.

If I go to offset 4660742*4096=19090399232 in wxhexeditor, indeed I see the file contents:

https://files.catbox.moe/6zvhx0.png

Final conclusion:

After some more testing, I have concluded: you cannot easily calculate the offset using the inode. Finding files across the disk requires using the inode tables to get the offset and actual file location. So an inode does not correlate with a physical/logical sequential disk location.

I created a new file, it received inode 21, but the offset was smaller than inode 19.

Was that a good use of 3 hours of my life? Well… I still have no idea what’s up with the Kardashians, so… I guess?

dario ,

Not much related, but I want to chime in to express my gratitude for what I consider the most underrated piece of software in the FOSS ecosystem. Better known hex editors pale in comparison to wxHexEditor in terms of features and user interface. I suggest you to tweak the colors for better viewing (I can share my configuration file) and to upgrade to the latest unstable revision because many important fixes landed since the last stable version.

luthis OP ,

Yeah definitely share your config! I’ve only just scratched the surface with wxHexEditor

dario , (edited ) 

<span style="color:#323232;">Language=English
</span><span style="color:#323232;">UpdateCheck=1
</span><span style="color:#323232;">LastUpdateCheckTime=1.698e+09
</span><span style="color:#323232;">ColourHexForeground=#DEDDDA
</span><span style="color:#323232;">ColourHexBackground=#000000
</span><span style="color:#323232;">ColourHexBackgroundZebra=#3D3846
</span><span style="color:#323232;">ColourHexSelectionForeground=#000000
</span><span style="color:#323232;">ColourHexSelectionBackground=#613583
</span><span style="color:#323232;">UseCustomHexFormat=0
</span><span style="color:#323232;">CustomHexFormat=xx 
</span><span style="color:#323232;">UseBytesPerLineLimit=1
</span><span style="color:#323232;">BytesPerLineLimit=16
</span><span style="color:#323232;">CharacterEncodingFamily=DOS
</span><span style="color:#323232;">CharacterEncoding=OEM - IBM PC/DOS CP437 - MS-DOS Latin US
</span><span style="color:#323232;">FontSize=10
</span><span style="color:#323232;">AutoShowTagPanel=1
</span><span style="color:#323232;">ScreenX=26
</span><span style="color:#323232;">ScreenY=23
</span><span style="color:#323232;">ScreenW=618
</span><span style="color:#323232;">ScreenH=716
</span><span style="color:#323232;">ScreenFullScreen=0
</span><span style="color:#323232;">FakeBlockLines=0
</span><span style="color:#323232;">FakeBlockSize=8k
</span><span style="color:#323232;">SingleInstance=0
</span><span style="color:#323232;">ZebraStriping=1
</span><span style="color:#323232;">SelectedChecksumFunctions=32648
</span><span style="color:#323232;">CompareOptions=0
</span><span style="color:#323232;">CompareOptionStopAfter=0
</span><span style="color:#323232;">CompareOptionMergeSection=0
</span>
chunkyhairball ,

Luthis, you’re doing God’s work here. You are learning by experimentation and then, importantly, documenting and sharing what you’ve learned. There is absolutely zero wrong and only good to be had in either of those and in combining them, you’re doing service to our entire community.

luthis OP ,

Thanks! I will keep it up!

Azzk1kr ,

You wasted three hours so you can share this knowledge :D

luthis OP ,

True, now you have the power to find your files manually!

SaltyIceteaMaker ,

Of course that was worth 3 hours. Every tinkering/experimenting is worth it. In the worst case you gain experience

luthis OP ,

Yeah now I stand a better chance of recovering files if something catastrophic happens

mvirts ,

Sounds like a good time to me!! Hey and look at all that wasted space you found 😹

luthis OP ,

Tried a different way:


<span style="color:#323232;"> filefrag -v testfile 
</span><span style="color:#323232;">Filesystem type is: ef53
</span><span style="color:#323232;">File size of testfile is 6 (1 block of 4096 bytes)
</span><span style="color:#323232;"> ext:     logical_offset:        physical_offset: length:   expected: flags:
</span><span style="color:#323232;">   0:        0..       0:    4660742..   4660742:      1:             last,eof
</span>

Went to offset 4660742 in wxhexeditor, but still when I copy out the hex and convert to ascii, it’s nonsense

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • [email protected]
  • random
  • lifeLocal
  • goranko
  • All magazines
    •