Understanding the 'debugfs' Filesystem Debugger (with examples)

‘debugfs’ is an essential tool for system administrators and IT professionals working with ext2, ext3, and ext4 filesystems. As an interactive filesystem debugger, it allows users to explore and manipulate filesystem data structures, making it invaluable for troubleshooting and understanding the intricacies of Linux filesystem behavior. With numerous features that grant detailed insights, ‘debugfs’ is a powerful utility for both read-only analysis and read-write modifications.

Use case 1: Open the filesystem in read-only mode

Code:

debugfs /dev/sdXN

Motivation:

Often, system administrators need to investigate a filesystem without making any accidental changes. The read-only mode ensures a safe environment for examining the current state and metadata of the filesystem. This is particularly useful in situations where data integrity is critical, such as forensic analysis or when performing audits.

Explanation:

• debugfs: This invokes the debugfs tool, initiating the interactive filesystem debugger.
• /dev/sdXN: This specifies the disk partition. sdX is a placeholder for the disk identifier, and N is the partition number. Adjust this according to your system’s specific disk and partition you wish to analyze.

Example Output:

debugfs 1.45.6 (20-Mar-2020)
debugfs:  mount - (null) [READ-ONLY]

Use case 2: Open the filesystem in read-write mode

Code:

debugfs -w /dev/sdXN

Motivation:

When there is a need to modify files, directories, or other data structures within a filesystem, opening it in read-write mode is necessary. This mode is useful for repairing filesystem inconsistencies or modifying metadata directly, such as restoring files from lost+found.

Explanation:

• -w: This flag tells debugfs to open the filesystem in a read-write mode, allowing modifications.
• /dev/sdXN: Similar to the previous example, this refers to the specific disk and partition.

Example Output:

debugfs 1.45.6 (20-Mar-2020)
debugfs: mount - /dev/sdXN [READ-WRITE]

Use case 3: Read commands from a specified file, execute them, and then exit

Code:

debugfs -f path/to/cmd_file /dev/sdXN

Motivation:

Automating routine queries or tasks using a command file is efficient, especially when dealing with repetitive tasks. Administrators can predefine a set of instructions in a file and use this feature to execute them all at once, thus saving time and reducing the risk of errors from manual input.

Explanation:

• -f path/to/cmd_file: This option specifies that debugfs should read and execute commands from a file located at path/to/cmd_file.
• /dev/sdXN: Indicates the target disk and partition.

Example Output:

Assuming the command file contains a simple ‘stats’ command:

Reading commands from file ...
Filesystem logical blocks: 32768
Filesystem clusters: 16384
...

Use case 4: View the filesystem stats in debugfs console

Code:

stats

Motivation:

Viewing the current state of the filesystem, such as block counts, free blocks, and inode counts, can provide insight into filesystem health and utilization. It’s an essential step in diagnosing performance issues or understanding usage patterns.

Explanation:

• stats: A direct command used within the debugfs console to display various statistics about the filesystem.

Example Output:

Filesystem volume name: <none>
Last mounted on: /mount/point
Filesystem UUID: e3c0...
Filesystem magic number: 0xEF53
Filesystem state: clean
Blocks count: 267774464
Reserved block count: 13403544
...

Use case 5: Close the filesystem

Code:

close -a

Motivation:

It’s crucial to properly disconnect from sessions after use to prevent data corruption and ensure system stability, especially after modifying data or structures on a filesystem.

Explanation:

• close: A command used within debugfs to terminate access to the current filesystem.
• -a: This option denotes to close all open files within the debugfs session.

Example Output:

Filesystem closed.

Use case 6: List all available commands

Code:

lr

Motivation:

For users unacquainted with debugfs or looking to explore its capabilities, listing all commands provides an overview of the available operations. This aids in learning and utilizing the tool more effectively.

Explanation:

• lr: This command lists all the available commands within the debugfs interface, showcasing its extensive functionality.

Example Output:

Available debugfs commands:
open          Open a filesystem
close         Close the filesystem
stats         Print filesystem stats
bmap          Block map
inode         Inode information
...

Conclusion:

The ‘debugfs’ tool offers a flexible and powerful interface for analyzing and altering ext2/3/4 filesystems at a low level. The examples provided demonstrate various common tasks that a system administrator or IT professional might need to perform. By mastering these use cases, users can effectively manage and troubleshoot filesystems, ensuring their optimal operation.