fileXray Example: Who Owns This Byte?

Suppose you want to know which file or folder (if any) “owns” a given byte on an HFS+ volume. If no regular file or folder owns the byte, is the byte part of a free block, or is it allocated to some internal file system data structure, such as the HFS+ Catalog B-Tree, etc.?

There could be several investigative reasons why you might want to know this, but it’s an interesting question by itself. fileXray can provide the answer.

The following examples show how to use the --who_owns_byte feature of fileXray. Byte offset 0 represents the beginning of the volume.

$ sudo fileXray --who_owns_byte 1023

$ sudo fileXray --who_owns_byte 1024
Volume Header

$ sudo fileXray /mach_kernel
  extents              =   startBlock   blockCount      % of file

                             0x1b71e6       0x11cf       100.00 %

$ sudo fileXray --who_owns_byte 0x1b71e6001

Note that in the case of /mach_kernel, we look at the file’s extents to know where the file begins on the volume. Since its first block is number 0x1b71e6 and the allocation block size for this volume is 4096 bytes, the file’s first byte is byte number 0x1b71e6000 on the volume.

Comments are closed.

All contents of this site, unless otherwise noted, are ©1994-2014 Amit Singh. All Rights Reserved.