linux-ext4 - Find Path by Inode For Multiple Hard Links?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <108000349.529858.1660525688786@connect.xfinity.com>
Date:   Sun, 14 Aug 2022 19:08:08 -0600 (MDT)
From:   "D. Stimits" <stimits@...cast.net>
To:     linux-ext4 <linux-ext4@...r.kernel.org>
Subject: Find Path by Inode For Multiple Hard Links?

Hi, 

I'm writing a simple tool to find the locations and dates of regular files on an ext4 filesystem which are unexpectedly showing up with multiple hard links (perhaps a script using "ln" without "-s" somewhere else). I'm trying to do this only in user space, and the naive approach would be that if I have a file name path with a known inode number, that I would then scan the entire partition for all files, and note when the inode matches. Then create my report based on details of each full path. What I am wondering is if there is a more efficient way (in user space) to present an inode number, and enumerate all file paths with that inode, and not have to scan the entire disk? If there is no other way I could do it the slow way, but I'm thinking someone here might know of a simple way to bypass scanning an entire partition. So far I don't know how to extract paths given an inode number other than brute force searching.

Thanks!