On 07/18/2015 07:10 PM, Ed Greshko wrote: > sudo debugfs -R 'ncheck 47972353' /dev/sda3 2>/dev/null debugfs -R 'ncheck 47972353' /dev/sda3 2>/dev/null Inode Pathname 47972353 //root So, why is it trying to do that? I am not logged in as root. How can I find out the process(es) that spawned sh to access /root?