From: Ed King ------------------------------------------------------ cd /etc cd samba/ cp smb.conf smb.conf.bak ls -i smb.conf.bak stat -f smb.conf.bak debugfs -R "stat /etc/samba/smb.conf.bak" /dev/sda2 dd skip=10576447 bs=4096 count=1 if=/dev/sda2 of=/tmp/block ls -l /tmp/block cat /tmp/block | less echo "some hidden data" | dd seek=3000 bs=1 of=/tmp/block ls -l /tmp/block cat /tmp/block | less dd seek=10576447 bs=4096 count=1 if=/tmp/block of=/dev/sda2 dd skip=10576447 bs=4096 count=1 if=/dev/sda2 | less tail smb.conf.bak

=============================================================== From: James Nylen ------------------------------------------------------ 1) How do you get from debugfs to 10576477? 2) Why would you do that?

=============================================================== From: Ed King ------------------------------------------------------ 10576477 is the data block where the /etc/samba/smb.conf.bak file lives on MY system. If you get multiple data blocks returned from debugfs, be sure to use the last one ;-)