debugfs Command in Linux

---

---

The debugfs command is a Linux filesystem debugger. It primarily solves file system problems by providing low-level access to the filesystem.

The debugfs can work with both mounted and unmounted filesystems. However, it is advised to unmount the filesystem to prevent data corruption.

Table of Contents

• Syntax for debugfs Command
• Options for debugfs Command
• Using debugfs Command in Linux
• Using debugfs Interactively
• Using debugfs Non-interactively

Note − You need root privileges to use the debugfs command on Linux.

Syntax for debugfs Command

The basic syntax of the debugfs command is as follows −

debugfs [options] [device]

The debugfs command comes with many options, and [options] from the above command will be replaced by them. Whereas, [device] signifies the mounted or unmounted filesystem.

Options for debugfs Command

The commonly used options for the debugfs filesystem are listed below −

Using debugfs Command in Linux

The debugfs command can be used in two different ways to debug the Linux filesystem −

• Interactively
• Non-Interactively

The interactive method is useful for quick in-terminal debugging while the non-interactive approach can be useful in scripting.

Using debugfs Interactively

To begin an interactive session of the debugfs command, execute it without any argument −

sudo debugfs

An interactive session will begin, as shown in the example output.

You need sudo permissions, otherwise you may not be able to request to open the filesystem.

The debugfs command supports various requests, some of which are listed below −

Now, lets use these requests.

Open the Filesystem

open /dev/sdNn

Here, /dev/sdNn can be /dev/sda1, /dev/sdb1, or /dev/vda1.

Note that the above will open the filesystem in read-only mode. To open it in read and write mode use -w flag.

open -w /dev/sdN

Listing the Content

To display the contents of a current working directory.

pwd

To list the content of the directory −

ls -l

Filename and inodes are listed.

The inode is a key concept in Unix and Unix-like operating systems. It is a short form of index node that contains metadata of the file or directory on a filesystem.

List the Deleted Content

To list the deleted content of the directory −

lsdel

The command found one deleted inode.

Creating a Directory

The mkdir command is used to create a directory −

mkdir directory

To verify, list the contents of the directory.

Note − To create a directory, ensure that your filesystem is opened in read and write mode using the -w flag.

Dump the Content of a File

To dump the contents of a file to stdout, use the cat command −

cat file.txt

Displaying Statistics of a file or Directory

To display the inode information of a file or directory, use −

stat file.txt

Recovering the Deleted File Content

To recover the content of the deleted file, use the dump command. Find the inode information of the deleted file/directory using the lsdel command.

Then use the dump command along with the inode number of the deleted file in the angled brackets −

dump <inode> /directory/filename

Lets verify by checking the contents of the /mnt directory.

Viewing Superblock Information

To display the information of the superblock, use the stats command. The superblock in Linux records the characteristics of the filesystem.

stats 

Closing Filesystem

To close the filesystem, use −

close

Note that closing the filesystem only closes the filesystem, not the debugfs session.

To Display Help

To get quick details of the requests, type help or h and press Return −

help

Exiting the Session

To quit the interactive session of the Linux debugfs command, type quit or q and press Enter.

quit

This command ends the debugfs command session.

Using debugfs Non-interactively

The debugfs command can also be used in a non-interactive way. The -R flag is used with the request string and filesystem. The one-liner usage gives the flexibility of using the debugfs command in scripting.

Use the following syntax to execute the commands in a single line.

sudo debugfs -R '[command]' [device]

To open the file system read and write both modes, then use the -w flag.

sudo debugfs -wR '[command]' [device]

For example −

sudo debugfs -R 'pwd' /dev/vda2 

Similarly, to create the directory −

sudo debugfs -wR 'mkdir directory' /dev/vda2

Run any command, using the syntax given above.

Conclusion

The debugfs is a filesystem debugger on Unix and Unix-like operating systems. It gives low-level access to the ext1, ext2, or ext3 filesystem. It is a powerful tool to inspect the inode information, examine block usage, and recover deleted files.

This guide covers the basic syntax, options, and various examples of using the debugfs command.