Is there a way to be sure a file is not truncated compared to the file size stored in the inode table? (Does a dd command do?)
0
votes
1
answer
193
views
I work on an ext4 filesystem. I have doubts about the accuracy of a directory entry regarding the description of a file that I have copied from an NTFS filesystem and that might have spanned some bad sectors (but I am not sure). I now believe the file might have been truncated when copied from its source but that the directory entry in the ext4 filesystem does not reflect the now-truncated file size but rather kept the information of the file size from the NTFS filesystem table. I don't know if such a situation is possible, but I want to be sure the file is not truncated (unfortunately the file is in a proprietary format and I cannot just open the file to check it).
I run a
dd
command on the file toward /dev/null
and it seemed to have "copied" as much as the original file size. However, I am now wondering whether the dd
command used the meta data about the file size from the inode table, which would defeat the goal.
- Can it be that after copying a file the inode table doesn't reflect the real size of what was actually copied? (I think I just did a click-and-drag in a file explorer)?
- Is using the dd
command a good option?
- Are there metadata in the ext4 filesystem that could be used to independently check the size of the file and thus accuracy of the information in the inode table (I think about data integrity fields)?
Asked by The Quark
(402 rep)
Nov 12, 2022, 07:12 PM
Last activity: Nov 12, 2022, 08:07 PM
Last activity: Nov 12, 2022, 08:07 PM