{"id":1953,"date":"2026-07-22T14:41:00","date_gmt":"2026-07-22T13:41:00","guid":{"rendered":"https:\/\/www.halkynconsulting.co.uk\/a\/?p=1953"},"modified":"2026-07-22T17:04:28","modified_gmt":"2026-07-22T16:04:28","slug":"xfs-inode-disk-offset","status":"publish","type":"post","link":"https:\/\/www.halkynconsulting.co.uk\/a\/2026\/07\/xfs-inode-disk-offset\/","title":{"rendered":"Finding File Data in a Disk Image from an XFS Inode"},"content":{"rendered":"<p>XFS is the default filesystem for Red Hat Enterprise Linux and much of the cloud, yet commercial forensic tools still offer only patchy support for it. When a case turns on proving exactly where a file&#8217;s contents sit inside a disk image, examiners need to be able to walk from an XFS inode to a byte offset by hand. This post shows the full conversion, then introduces a small script that does the arithmetic for you \u2014 but only after you understand what the arithmetic is.<\/p>\n<h2>Why decode this manually?<\/h2>\n<p>Three reasons. First, tool coverage: The Sleuth Kit and most commercial suites handle EXT well but stumble on XFS structures, so manual verification is often the only way to confirm a finding. Second, evidence: if you extract file content at a specific offset, you should be able to demonstrate in a report precisely how that offset was derived. Third, recovery: when a file is deleted in XFS the directory entry is marked unused but the extent data in the inode can survive, so decoding extents by hand is sometimes the difference between recovering content and giving up.<\/p>\n<h2>Where the file address lives in the inode<\/h2>\n<p>An XFS version 3 inode (the type used on v5 filesystems) starts with a 176-byte core structure. Two fields matter here:<\/p>\n<ul>\n<li><strong>Byte 5 \u2014 data fork type.<\/strong> A value of <code>2<\/code> means the inode holds an array of extent records; this covers most ordinary files. (A value of <code>1<\/code> means the data is resident in the inode itself, and <code>3<\/code> means the fork holds the root of a B+tree, typical for very large or heavily fragmented files. The method below applies to type 2.)<\/li>\n<li><strong>Bytes 76\u201379 \u2014 extent count.<\/strong> How many extent records follow the core.<\/li>\n<\/ul>\n<p>The extent records themselves begin at byte offset 176, immediately after the core, and each one is exactly 16 bytes.<\/p>\n<h2>Decoding the XFS inode extent record<\/h2>\n<p>This is where it gets awkward. The 16-byte (128-bit) extent record is bit-packed, not byte-aligned, so you cannot simply read fields with a hex viewer. The layout is:<\/p>\n<ul>\n<li><strong>Flag<\/strong> \u2014 1 bit (set if the extent is preallocated\/unwritten)<\/li>\n<li><strong>Logical offset<\/strong> \u2014 54 bits (position of this extent within the file)<\/li>\n<li><strong>Start block<\/strong> \u2014 52 bits (the filesystem block where the data begins)<\/li>\n<li><strong>Block count<\/strong> \u2014 21 bits (length of the extent in blocks)<\/li>\n<\/ul>\n<p>Because 1 + 54 = 55 bits, the start block field begins partway through a byte. The only reliable way to read it is to convert the whole record to binary, count off the fields, and convert the pieces back.<\/p>\n<h3>A worked example<\/h3>\n<p>Take this extent record, read from byte 176 of an inode:<\/p>\n<pre>00 00 00 00 00 00 00 00 00 00 00 35 3F 40 00 01<\/pre>\n<p>Converted to binary and split into the four fields:<\/p>\n<pre>Flag:           0\r\nLogical offset: 000000000000000000000000000000000000000000000000000000\r\nStart block:    0000000000000000000000000000000000011010100111111010\r\nBlock count:    000000000000000000001<\/pre>\n<p>The flag is clear and the logical offset is zero \u2014 this extent is the start of the file. The block count is 1, so the file occupies a single block. Reading the start block bits back into hex: <code>0001 1010 1001 1111 1010<\/code> is <code>0x1A9FA<\/code>.<\/p>\n<p>That is a block address, not a byte address. Multiply by the filesystem block size (4,096 bytes here) to get the offset into the image:<\/p>\n<pre>0x1A9FA \u00d7 0x1000 = 0x1A9FA000 (446,668,800 decimal)<\/pre>\n<p>The file&#8217;s data begins 446,668,800 bytes into the filesystem. You can now extract it directly:<\/p>\n<pre>dd if=image.dd bs=4096 skip=$((0x1A9FA)) count=1 of=recovered.bin<\/pre>\n<p>or simply confirm what is there with <code>xxd -s 446668800 image.dd | head<\/code>.<\/p>\n<h2>A script to do the bit-shuffling<\/h2>\n<p>Converting 128 bits by hand is error-prone at 2 a.m. during an incident, so there is a helper script available: <a href=\"https:\/\/github.com\/TazWake\/Public\/blob\/master\/Bash\/xfs_inode_converter.sh\">xfs_inode_converter.sh<\/a>.<\/p>\n<p>It is deliberately simple, and it is worth being clear about exactly what it does:<\/p>\n<ol>\n<li>It takes the 16-byte extent record as its only argument \u2014 32 hex digits, no spaces (for the example above: <code>0000000000000000000000353F400001<\/code>).<\/li>\n<li>It converts the hex to binary using a character lookup table rather than <code>bc<\/code> (earlier versions used <code>bc<\/code>, which produced erratic output).<\/li>\n<li>It splits the binary string into the four fields at the 1, 54, 52, and 21-bit boundaries and prints each one, so you can check the working.<\/li>\n<li>It converts the 52-bit start block to decimal and hex.<\/li>\n<li>It multiplies the start block by 4,096 and reports the result as the byte offset into the filesystem, in both hex and decimal.<\/li>\n<\/ol>\n<p>In other words, the script performs precisely the manual process described above \u2014 nothing more. That matters for two reasons. First, if the output is ever challenged, you can reproduce every step by hand. Second, its assumptions are your responsibility to verify:<\/p>\n<ul>\n<li><strong>Block size.<\/strong> The script assumes 4,096-byte blocks. Confirm yours from bytes 4\u20137 of the superblock (<code>xfs_db -r -f image.dd -c \"sb 0\" -c \"p blocksize\"<\/code>) and scale the result if it differs.<\/li>\n<li><strong>One extent at a time.<\/strong> A fragmented file has multiple extent records; run the script against each 16-byte record and use the logical offset field to keep them in order.<\/li>\n<li><strong>Fork type.<\/strong> The input must come from a type 2 data fork. If byte 5 of the inode is <code>3<\/code>, the bytes at offset 176 are a B+tree root, not an extent record, and the output will be meaningless.<\/li>\n<\/ul>\n<h2>Validating the result<\/h2>\n<p>Good practice is to cross-check the conversion with <code>xfs_db<\/code>, which can decode extents itself: open the image read-only, select the inode with <code>inode &lt;number&gt;<\/code>, and print the block map. The <code>convert<\/code> command will also translate between address types (filesystem block, allocation group block, byte offset) if you want independent confirmation of the arithmetic. On filesystems with multiple allocation groups, remember that the start block is a filesystem block number that encodes the allocation group in its high bits \u2014 another reason a quick <code>xfs_db<\/code> sanity check is worthwhile before you commit an offset to a report.<\/p>\n<p>The technique is not complicated once the bit boundaries are understood \u2014 it is simply careful counting. Decode it by hand at least once; after that, let the script save you the eyestrain.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>How to decode the extent record in an XFS inode by hand and convert it to the exact byte offset of file data in a disk image, with a script to speed it up.<\/p>\n","protected":false},"author":4,"featured_media":1955,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ocean_post_layout":"","ocean_both_sidebars_style":"","ocean_both_sidebars_content_width":0,"ocean_both_sidebars_sidebars_width":0,"ocean_sidebar":"0","ocean_second_sidebar":"0","ocean_disable_margins":"enable","ocean_add_body_class":"","ocean_shortcode_before_top_bar":"","ocean_shortcode_after_top_bar":"","ocean_shortcode_before_header":"","ocean_shortcode_after_header":"","ocean_has_shortcode":"","ocean_shortcode_after_title":"","ocean_shortcode_before_footer_widgets":"","ocean_shortcode_after_footer_widgets":"","ocean_shortcode_before_footer_bottom":"","ocean_shortcode_after_footer_bottom":"","ocean_display_top_bar":"default","ocean_display_header":"default","ocean_header_style":"","ocean_center_header_left_menu":"0","ocean_custom_header_template":"0","ocean_custom_logo":0,"ocean_custom_retina_logo":0,"ocean_custom_logo_max_width":0,"ocean_custom_logo_tablet_max_width":0,"ocean_custom_logo_mobile_max_width":0,"ocean_custom_logo_max_height":0,"ocean_custom_logo_tablet_max_height":0,"ocean_custom_logo_mobile_max_height":0,"ocean_header_custom_menu":"0","ocean_menu_typo_font_family":"0","ocean_menu_typo_font_subset":"","ocean_menu_typo_font_size":0,"ocean_menu_typo_font_size_tablet":0,"ocean_menu_typo_font_size_mobile":0,"ocean_menu_typo_font_size_unit":"px","ocean_menu_typo_font_weight":"","ocean_menu_typo_font_weight_tablet":"","ocean_menu_typo_font_weight_mobile":"","ocean_menu_typo_transform":"","ocean_menu_typo_transform_tablet":"","ocean_menu_typo_transform_mobile":"","ocean_menu_typo_line_height":0,"ocean_menu_typo_line_height_tablet":0,"ocean_menu_typo_line_height_mobile":0,"ocean_menu_typo_line_height_unit":"","ocean_menu_typo_spacing":0,"ocean_menu_typo_spacing_tablet":0,"ocean_menu_typo_spacing_mobile":0,"ocean_menu_typo_spacing_unit":"","ocean_menu_link_color":"","ocean_menu_link_color_hover":"","ocean_menu_link_color_active":"","ocean_menu_link_background":"","ocean_menu_link_hover_background":"","ocean_menu_link_active_background":"","ocean_menu_social_links_bg":"","ocean_menu_social_hover_links_bg":"","ocean_menu_social_links_color":"","ocean_menu_social_hover_links_color":"","ocean_disable_title":"default","ocean_disable_heading":"default","ocean_post_title":"","ocean_post_subheading":"","ocean_post_title_style":"","ocean_post_title_background_color":"","ocean_post_title_background":0,"ocean_post_title_bg_image_position":"","ocean_post_title_bg_image_attachment":"","ocean_post_title_bg_image_repeat":"","ocean_post_title_bg_image_size":"","ocean_post_title_height":0,"ocean_post_title_bg_overlay":0.5,"ocean_post_title_bg_overlay_color":"","ocean_disable_breadcrumbs":"default","ocean_breadcrumbs_color":"","ocean_breadcrumbs_separator_color":"","ocean_breadcrumbs_links_color":"","ocean_breadcrumbs_links_hover_color":"","ocean_display_footer_widgets":"default","ocean_display_footer_bottom":"default","ocean_custom_footer_template":"0","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"ocean_post_oembed":"","ocean_post_self_hosted_media":"","ocean_post_video_embed":"","ocean_link_format":"","ocean_link_format_target":"self","ocean_quote_format":"","ocean_quote_format_link":"post","ocean_gallery_link_images":"on","ocean_gallery_id":[],"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[5],"tags":[147,137,49,182],"class_list":["post-1953","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-cybersecurity","tag-incident-response","tag-investigations","tag-linux","entry","has-media"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>XFS Inode to Disk Offset: Finding File Data | Halkyn Consulting<\/title>\n<meta name=\"description\" content=\"Learn how to decode the extent record in an XFS inode and convert it to the exact byte offset of file data in a disk image, step by step.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.halkynconsulting.co.uk\/a\/2026\/07\/xfs-inode-disk-offset\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"XFS Inode to Disk Offset: Finding File Data | Halkyn Consulting\" \/>\n<meta property=\"og:description\" content=\"Learn how to decode the extent record in an XFS inode and convert it to the exact byte offset of file data in a disk image, step by step.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.halkynconsulting.co.uk\/a\/2026\/07\/xfs-inode-disk-offset\/\" \/>\n<meta property=\"og:site_name\" content=\"Halkyn Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-22T13:41:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-22T16:04:28+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2026\/07\/featured-image.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Staff Writer\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@HalkynSecurity\" \/>\n<meta name=\"twitter:site\" content=\"@HalkynSecurity\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Staff Writer\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/2026\\\/07\\\/xfs-inode-disk-offset\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/2026\\\/07\\\/xfs-inode-disk-offset\\\/\"},\"author\":{\"name\":\"Staff Writer\",\"@id\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/#\\\/schema\\\/person\\\/58ede4740a169265ec326ea4afd1c97d\"},\"headline\":\"Finding File Data in a Disk Image from an XFS Inode\",\"datePublished\":\"2026-07-22T13:41:00+00:00\",\"dateModified\":\"2026-07-22T16:04:28+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/2026\\\/07\\\/xfs-inode-disk-offset\\\/\"},\"wordCount\":916,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/2026\\\/07\\\/xfs-inode-disk-offset\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/www.halkynconsulting.co.uk\\\/a\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/featured-image.png?fit=1200%2C630&ssl=1\",\"keywords\":[\"Cybersecurity\",\"Incident Response\",\"Investigations\",\"Linux\"],\"articleSection\":[\"Security\"],\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/2026\\\/07\\\/xfs-inode-disk-offset\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/2026\\\/07\\\/xfs-inode-disk-offset\\\/\",\"url\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/2026\\\/07\\\/xfs-inode-disk-offset\\\/\",\"name\":\"XFS Inode to Disk Offset: Finding File Data | Halkyn Consulting\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/2026\\\/07\\\/xfs-inode-disk-offset\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/2026\\\/07\\\/xfs-inode-disk-offset\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/www.halkynconsulting.co.uk\\\/a\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/featured-image.png?fit=1200%2C630&ssl=1\",\"datePublished\":\"2026-07-22T13:41:00+00:00\",\"dateModified\":\"2026-07-22T16:04:28+00:00\",\"description\":\"Learn how to decode the extent record in an XFS inode and convert it to the exact byte offset of file data in a disk image, step by step.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/2026\\\/07\\\/xfs-inode-disk-offset\\\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/2026\\\/07\\\/xfs-inode-disk-offset\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/2026\\\/07\\\/xfs-inode-disk-offset\\\/#primaryimage\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/www.halkynconsulting.co.uk\\\/a\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/featured-image.png?fit=1200%2C630&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/www.halkynconsulting.co.uk\\\/a\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/featured-image.png?fit=1200%2C630&ssl=1\",\"width\":1200,\"height\":630,\"caption\":\"Extracting an XFS inode involves analyzing the individual bits\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/2026\\\/07\\\/xfs-inode-disk-offset\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Halkyn Security\",\"item\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security\",\"item\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/category\\\/security\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Finding File Data in a Disk Image from an XFS Inode\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/#website\",\"url\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/\",\"name\":\"Halkyn Security Blog\",\"description\":\"Specialist Security &amp; Risk Management Consultants\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/#organization\",\"name\":\"Halkyn Consulting\",\"url\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/www.halkynconsulting.co.uk\\\/a\\\/wp-content\\\/uploads\\\/2011\\\/07\\\/Untitled-1.png?fit=990%2C170&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/www.halkynconsulting.co.uk\\\/a\\\/wp-content\\\/uploads\\\/2011\\\/07\\\/Untitled-1.png?fit=990%2C170&ssl=1\",\"width\":\"990\",\"height\":\"170\",\"caption\":\"Halkyn Consulting\"},\"image\":{\"@id\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/HalkynSecurity\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/2329571\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/#\\\/schema\\\/person\\\/58ede4740a169265ec326ea4afd1c97d\",\"name\":\"Staff Writer\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/730d6d5d0dc5b9af3fc83ce16468007ab0cb3ea422ff32561707ef3914d36d93?s=96&d=retro&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/730d6d5d0dc5b9af3fc83ce16468007ab0cb3ea422ff32561707ef3914d36d93?s=96&d=retro&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/730d6d5d0dc5b9af3fc83ce16468007ab0cb3ea422ff32561707ef3914d36d93?s=96&d=retro&r=g\",\"caption\":\"Staff Writer\"},\"url\":\"https:\\\/\\\/www.halkynconsulting.co.uk\\\/a\\\/author\\\/content-team\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"XFS Inode to Disk Offset: Finding File Data | Halkyn Consulting","description":"Learn how to decode the extent record in an XFS inode and convert it to the exact byte offset of file data in a disk image, step by step.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.halkynconsulting.co.uk\/a\/2026\/07\/xfs-inode-disk-offset\/","og_locale":"en_GB","og_type":"article","og_title":"XFS Inode to Disk Offset: Finding File Data | Halkyn Consulting","og_description":"Learn how to decode the extent record in an XFS inode and convert it to the exact byte offset of file data in a disk image, step by step.","og_url":"https:\/\/www.halkynconsulting.co.uk\/a\/2026\/07\/xfs-inode-disk-offset\/","og_site_name":"Halkyn Security Blog","article_published_time":"2026-07-22T13:41:00+00:00","article_modified_time":"2026-07-22T16:04:28+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2026\/07\/featured-image.png","type":"image\/png"}],"author":"Staff Writer","twitter_card":"summary_large_image","twitter_creator":"@HalkynSecurity","twitter_site":"@HalkynSecurity","twitter_misc":{"Written by":"Staff Writer","Estimated reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.halkynconsulting.co.uk\/a\/2026\/07\/xfs-inode-disk-offset\/#article","isPartOf":{"@id":"https:\/\/www.halkynconsulting.co.uk\/a\/2026\/07\/xfs-inode-disk-offset\/"},"author":{"name":"Staff Writer","@id":"https:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/58ede4740a169265ec326ea4afd1c97d"},"headline":"Finding File Data in a Disk Image from an XFS Inode","datePublished":"2026-07-22T13:41:00+00:00","dateModified":"2026-07-22T16:04:28+00:00","mainEntityOfPage":{"@id":"https:\/\/www.halkynconsulting.co.uk\/a\/2026\/07\/xfs-inode-disk-offset\/"},"wordCount":916,"commentCount":0,"publisher":{"@id":"https:\/\/www.halkynconsulting.co.uk\/a\/#organization"},"image":{"@id":"https:\/\/www.halkynconsulting.co.uk\/a\/2026\/07\/xfs-inode-disk-offset\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2026\/07\/featured-image.png?fit=1200%2C630&ssl=1","keywords":["Cybersecurity","Incident Response","Investigations","Linux"],"articleSection":["Security"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.halkynconsulting.co.uk\/a\/2026\/07\/xfs-inode-disk-offset\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.halkynconsulting.co.uk\/a\/2026\/07\/xfs-inode-disk-offset\/","url":"https:\/\/www.halkynconsulting.co.uk\/a\/2026\/07\/xfs-inode-disk-offset\/","name":"XFS Inode to Disk Offset: Finding File Data | Halkyn Consulting","isPartOf":{"@id":"https:\/\/www.halkynconsulting.co.uk\/a\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.halkynconsulting.co.uk\/a\/2026\/07\/xfs-inode-disk-offset\/#primaryimage"},"image":{"@id":"https:\/\/www.halkynconsulting.co.uk\/a\/2026\/07\/xfs-inode-disk-offset\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2026\/07\/featured-image.png?fit=1200%2C630&ssl=1","datePublished":"2026-07-22T13:41:00+00:00","dateModified":"2026-07-22T16:04:28+00:00","description":"Learn how to decode the extent record in an XFS inode and convert it to the exact byte offset of file data in a disk image, step by step.","breadcrumb":{"@id":"https:\/\/www.halkynconsulting.co.uk\/a\/2026\/07\/xfs-inode-disk-offset\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.halkynconsulting.co.uk\/a\/2026\/07\/xfs-inode-disk-offset\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.halkynconsulting.co.uk\/a\/2026\/07\/xfs-inode-disk-offset\/#primaryimage","url":"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2026\/07\/featured-image.png?fit=1200%2C630&ssl=1","contentUrl":"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2026\/07\/featured-image.png?fit=1200%2C630&ssl=1","width":1200,"height":630,"caption":"Extracting an XFS inode involves analyzing the individual bits"},{"@type":"BreadcrumbList","@id":"https:\/\/www.halkynconsulting.co.uk\/a\/2026\/07\/xfs-inode-disk-offset\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Halkyn Security","item":"https:\/\/www.halkynconsulting.co.uk\/a\/"},{"@type":"ListItem","position":2,"name":"Security","item":"https:\/\/www.halkynconsulting.co.uk\/a\/category\/security\/"},{"@type":"ListItem","position":3,"name":"Finding File Data in a Disk Image from an XFS Inode"}]},{"@type":"WebSite","@id":"https:\/\/www.halkynconsulting.co.uk\/a\/#website","url":"https:\/\/www.halkynconsulting.co.uk\/a\/","name":"Halkyn Security Blog","description":"Specialist Security &amp; Risk Management Consultants","publisher":{"@id":"https:\/\/www.halkynconsulting.co.uk\/a\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.halkynconsulting.co.uk\/a\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/www.halkynconsulting.co.uk\/a\/#organization","name":"Halkyn Consulting","url":"https:\/\/www.halkynconsulting.co.uk\/a\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/logo\/image\/","url":"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2011\/07\/Untitled-1.png?fit=990%2C170&ssl=1","contentUrl":"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2011\/07\/Untitled-1.png?fit=990%2C170&ssl=1","width":"990","height":"170","caption":"Halkyn Consulting"},"image":{"@id":"https:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/HalkynSecurity","https:\/\/www.linkedin.com\/company\/2329571"]},{"@type":"Person","@id":"https:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/58ede4740a169265ec326ea4afd1c97d","name":"Staff Writer","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/secure.gravatar.com\/avatar\/730d6d5d0dc5b9af3fc83ce16468007ab0cb3ea422ff32561707ef3914d36d93?s=96&d=retro&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/730d6d5d0dc5b9af3fc83ce16468007ab0cb3ea422ff32561707ef3914d36d93?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/730d6d5d0dc5b9af3fc83ce16468007ab0cb3ea422ff32561707ef3914d36d93?s=96&d=retro&r=g","caption":"Staff Writer"},"url":"https:\/\/www.halkynconsulting.co.uk\/a\/author\/content-team\/"}]}},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2026\/07\/featured-image.png?fit=1200%2C630&ssl=1","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p9yHvD-vv","jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/posts\/1953","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/comments?post=1953"}],"version-history":[{"count":2,"href":"https:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/posts\/1953\/revisions"}],"predecessor-version":[{"id":1956,"href":"https:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/posts\/1953\/revisions\/1956"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/media\/1955"}],"wp:attachment":[{"href":"https:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/media?parent=1953"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/categories?post=1953"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/tags?post=1953"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}