Reattach inode to lost&found / what file is it?

[thomas.e.lowe]

>After fsck reattaches a file to directory lost&found,
>it names it with the inode.  Is there a nice neat way
>of determining what file this was originally?
 
>Usually I use 'file' to learn more about it, then
>try to deduce from the type or contents, what it is.
>
 But if it's an object file, I usually search the string 
>table (if it has one) or the symbol table, to try to
>figure out what it is...
 
>Isn't there a more sophistocated method to identify
>an object?
 
>	Tanya

Unfortunately, No there isn't.  The reason is that UNIX(R) keeps all of the
information specific to a file in something called an inode.  This information
includes such items as permissions, creation, modification, and access
dates, ownership, groupership(new word), size, and address of data blocks on
the disk where that file resides.  There are several other things, but none of
which is the NAME of the file.  

The names of the files are kept ONLY in the directory files.  Directory files
are simply lists of file names and inode numbers, nothing more. Remember that
one file can be referenced by more than one name, and even in more than
one directory by use of links (the ln command).  When fsck has to put an inode
in lost+found, it's because it can't find any reference to that inode in
any directory on the file system, thus it can't find it's name.  

I hope this answers the question.  Note that this information may be System V
specific, but probably applies to most other versions.


-- 
Tom Lowe    tel at hound.ATT.COM or  att!hound!tel     201-949-0428
AT&T Bell Laboratories, Room 2E-637A
Crawfords Corner Road,  Holmdel, NJ  07733
(R) UNIX is a registered trademark of AT&T  (keep them lawyers happy!!)