Geek Answers Handbook

Read the entire physical file, including file failure with python?

Is there an easy way to read all selected clusters of a given file using python? Regular python read (), apparently, only allows me to read to the logical size of the file (which, of course, is reasonable), but I want to read all the clusters, including free space.

For example, I have a file called "test.bin" with a size of 1234 bytes in a logical size, but since my file system uses a cluster of 4096 bytes in size, the file has a physical size of 4096 bytes on disk. Ie, There are 2862 bytes in the file waiting space.

I'm not sure where to even start with this problem ... I know that I can read the raw disk from / dev / sda, but I'm not sure how to find the clusters of interest to you ... of course that is the whole point of having a file system (so combine file names with sectors on the disk), but I don’t know enough about how python interacts with the file system to understand this ... else .. any help or pointers to links would be greatly appreciated.

+4
source share
2 answers

Assuming the ext2 / 3/4 fileytem file, as you might guess, is best:

  • use a wrapper (like this one ) around debugfs to get a list of blocks associated with this file:

    debugfs:  blocks ./f.txt
2562

  • to read a block (s) from a block / image of a file

    >>> f = open('/tmp/test.img','rb')
>>> f.seek(2562*4*1024)
10493952
>>> bytes = f.read(4*1024)
>>> bytes
b'Some data\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
...

, . , FS, . - , / .

0

C- , . . . POSIX open(), ( ), POSIX read() write() EOF, .

, python, .

0

More articles:


All Articles