Home / ubuntu / Questions / 1194308
In Process
BruhMoment34
Asked: 2019-12-07 06:57:15 +0800 CST

How to find files in a given sector?

  • 772

I'm currently trying to find a file that was hidden in sector 2047. My root partition starts at sector 2048.
How would I go about finding that file? Given the only info I have is the sector its in.
Thanks in advance!

partitioning sector-size

2 Answers

  1. There's no file hidden in sector 2047. There may be data, but it's not part of the file system.

    To recover it:

    1. Figure out sector size of disk
    2. Read sector with e.g. dd

    Figure out sector size

    sudo fdisk -l will show you sector sizes:

    $ sudo fdisk -l
[sudo] password for root: 
Disk /dev/sda: 238.5 GiB, 256060514304 bytes, 500118192 sectors
Disk model: SAMSUNG MZ7TY256
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt

    Here we have 512B sectors. This is probably the most common; some newer devices will have 4KB sector sizes. This is the reason we need to know the sector size of the device - we have to specify it in the next step, so dd knows how many bytes to skip.

    Read out said sector

    This dd can do for us.

    sudo dd if=/dev/sda of=sector2047 bs=512 skip=2046 count=1
    • if=/dev/sda tells dd to read from /dev/sda
    • of=sector2047 tells dd to write to the file sector2047
    • bs=512 tells dd to read in 512B increments (block size)
    • skip=2046 tells dd to skip first 2046 512B-blocks
    • count=1 tells dd to read 1 block of 512B.
    • 9

  2. I would use the same command vidarlo used, but change the skip=2046 to skip=2047 and the count=1 to count=3. This will give a bigger space to search in.

    Then do sudo apt install hexedit. After that, do hexedit sector2047 and scroll down until you see your message on the left.

    • 2