debugfs

interactive debugger for ext2/ext3/ext4 filesystems

TLDR

Open filesystem in read-only mode

$ debugfs [/dev/sdXN]

Open filesystem in read-write mode

$ debugfs -w [/dev/sdXN]

Read commands from file

$ debugfs -f [path/to/cmd_file] [/dev/sdXN]

Execute a single command and exit

$ debugfs -R "stats" [/dev/sdXN]

List deleted inodes (interactive)

$ lsdel

Recover a deleted inode to a file (interactive)

$ dump <[inode_number]> [/path/to/output]

debugfs is an interactive debugger for ext2/ext3/ext4 filesystems. It allows direct manipulation of filesystem structures, which is useful for data recovery, analysis, and troubleshooting.Can be used to recover deleted files, examine inodes, and manually fix filesystem issues.

PARAMETERS

-w

Open in read-write mode (default is read-only)

-c

Open in catastrophic mode (inode and group bitmaps not read initially, forces read-only)

-n

Disable metadata checksum verification

-f cmdfile_

Read and execute commands from file, then exit

-R request

Execute a single command and exit

-b blocksize

Force a specific block size in bytes instead of auto-detecting

-s superblock

Read superblock from the given block number (requires -b)

-i

Treat device as an ext2 image file created by e2image

-D

Open device using Direct I/O, bypassing the buffer cache

-z undofile_

Write old block contents to an undo file before overwriting (for use with e2undo)

INTERACTIVE COMMANDS

stats

Show filesystem statistics

ls dir

List directory contents

cat file

Display file contents

lsdel

List deleted inodes

undel <inode> [pathname]

Undelete inode and optionally link to pathname

dump inode file

Dump inode contents to a file

ncheck inode

Translate inode numbers to pathnames

icheck block

Translate block numbers to inodes

logdump

Dump ext3/ext4 journal contents

INSTALL

sudo apt install e2fsprogs

sudo dnf install e2fsprogs

sudo pacman -S e2fsprogs

sudo apk add e2fsprogs-extra

sudo zypper install e2fsprogs

brew install e2fsprogs

nix profile install nixpkgs#e2fsprogs

CAVEATS

Requires root privileges. Use with extreme caution in write mode. Unmount filesystem before making changes. Improper use can cause data loss.