# debugfs can search for directory entries by name # even without a valid path debugfs -c /dev/nbd0 << 'EOF' stat <1585918> EOF # Use the parent inode from stat to walk upward # inode 1585918 is 'volumes' - its .. entry points to pterodactyl dir # pterodactyl's .. points to lib # lib's .. points to var # Find parent chain by reading .. entries python3 -c " import subprocess def get_parent(inode): r = subprocess.run( ['debugfs', '-c', '-R', f'ls -l <{inode}>', '/dev/nbd0'], capture_output=True, text=True ) for line in r.stdout.splitlines(): if '..' in line: parts = line.split() for p in parts: try: n = int(p) if n > 0 and n != inode: return n except: pass return None def get_name(inode): r = subprocess.run( ['debugfs', '-c', '-R', f'stat <{inode}>', '/dev/nbd0'], capture_output=True, text=True ) return r.stdout[:200] # Walk up from volumes inode inode = 1585918 chain = [inode] print(f'Walking up from inode {inode} (volumes)...') for i in range(10): parent = get_parent(inode) if parent is None or parent == inode or parent in chain: break print(f' inode {inode} -> parent {parent}') chain.append(parent) inode = parent print(f'Chain: {chain}') print() # Now list each parent to find siblings of pterodactyl/volumes for ino in chain[1:]: print(f'Contents of inode {ino}:') r = subprocess.run( ['debugfs', '-c', '-R', f'ls <{ino}>', '/dev/nbd0'], capture_output=True, text=True ) print(r.stdout[:500]) print() "