This is an old revision of the document!

Map LBA to File

You might see something like this on your console / dmesg:

[  394.051961] end_request: I/O error, dev sda, sector 128999424
[  394.055674] Buffer I/O error on device sda3, logical block 8800768

In this situation you can use the following assumptions: * The bad sector / LBA is 128999424 (L) * The bad block is 8800768 in the filesystem on sda3 (b)

How to:

For this example, I'll be using the following information. The second line of the output above was not provided, we need to calculate the logical block offset first.

Bad LBA = 0x0a8ae67d = 176875133

Find out the partition

$ sudo fdisk -lu /dev/sda

Disk /dev/sda: 500.1 GB, 500107862016 bytes
255 heads, 63 sectors/track, 60801 cylinders, total 976773168 sectors
Units = sectors of 1 * 512 = 512 bytes
Disk identifier: 0x030818eb

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *          63      409662      204800   83  Linux
/dev/sda2          409663   168181822    83886080   83  Linux
/dev/sda3       168181823   172376126     2097152   82  Linux swap / Solaris
/dev/sda4       172376127   976768064   402195969   83  Linux

Therefore this LBA is on partition: /dev/sda4

Get block size of the partition

$ sudo tune2fs -l /dev/sda4 | grep Block
Block count:              100548992
Block size:               4096
Blocks per group:         32768

This partition has block size: 4096

Calculate the block

b = (int)(((L-S)*512)/B)

where:

  b = File System block number
  B = File system block size in bytes
  L = LBA of bad sector
  S = Starting sector of partition as shown by fdisk -lu

Denotes the integer part (round it DOWN to a whole number).

b = (int)((176875133-172376127) * 512 / 4096)
b = (int)562375.75
b = 562375

The block on this partition corresponding to this LBA is: 562375

Identify the file

Use debugfs to locate the inode stored in this block, and the file that contains that inode:

$ sudo debugfs

debugfs 1.41.9 (22-Aug-2009)
debugfs:  open /dev/sda4
debugfs:  testb 562375
Block 562375 marked in use
debugfs:  icheck 562375
Block   Inode number
562375  132344
debugfs:  ncheck 132344
Inode   Pathname
132344  /attie/banner.jpg
debugfs:  quit

Or if the block appears not in use anymore:

$ sudo debugfs
debugfs 1.41.9 (22-Aug-2009)
debugfs:  open /dev/sda4
debugfs:  testb 562375
Block 562375 not in use
debugfs:  quit