To run a command as administrator (user "root"), use "sudo ". See "man sudo_root" for details. lubuntu@lubuntu:~$ fsdebug fsdebug: command not found lubuntu@lubuntu:~$ debugfs debugfs 1.44.6 (5-Mar-2019) debugfs: debugfs: help Available debugfs requests: show_debugfs_params, params Show debugfs parameters open_filesys, open Open a filesystem close_filesys, close Close the filesystem freefrag, e2freefrag Report free space fragmentation feature, features Set/print superblock features dirty_filesys, dirty Mark the filesystem as dirty init_filesys Initialize a filesystem (DESTROYS DATA) show_super_stats, stats Show superblock statistics ncheck Do inode->name translation icheck Do block->inode translation change_root_directory, chroot Change root directory change_working_directory, cd Change working directory list_directory, ls List directory show_inode_info, stat Show inode information dump_extents, extents, ex Dump extents information blocks Dump blocks used by an inode filefrag Report fragmentation information for an inode link, ln Create directory link unlink Delete a directory link mkdir Create a directory rmdir Remove a directory rm Remove a file (unlink and kill_file, if appropriate) kill_file Deallocate an inode and its blocks copy_inode Copy the inode structure clri Clear an inode's contents freei Clear an inode's in-use flag seti Set an inode's in-use flag testi Test an inode's in-use flag freeb Clear a block's in-use flag setb Set a block's in-use flag testb Test a block's in-use flag modify_inode, mi Modify an inode by structure find_free_block, ffb Find free block(s) find_free_inode, ffi Find free inode(s) print_working_directory, pwd Print current working directory expand_dir, expand Expand directory mknod Create a special file list_deleted_inodes, lsdel List deleted inodes undelete, undel Undelete file write Copy a file from your native filesystem dump_inode, dump Dump an inode out to a file cat Dump an inode out to stdout lcd Change the current directory on your native filesystem rdump Recursively dump a directory to the native filesystem set_super_value, ssv Set superblock value set_inode_field, sif Set inode field set_block_group, set_bg Set block group descriptor field logdump Dump the contents of the journal htree_dump, htree Dump a hash-indexed directory dx_hash, hash Calculate the directory hash of a filename dirsearch Search a directory for a particular filename bmap Calculate the logical->physical block mapping for an inode fallocate Allocate uninitialized blocks to an inode punch, truncate Punch (or truncate) blocks from an inode by deallocating them symlink Create a symbolic link imap Calculate the location of an inode dump_unused Dump unused blocks set_current_time Set current time to use when setting filesystem fields supported_features Print features supported by this version of e2fsprogs dump_mmp Dump MMP information set_mmp_value, smmp Set MMP value extent_open, eo Open inode for extent manipulation zap_block, zap Zap block: fill with 0, pattern, flip bits etc. block_dump, bdump, bd Dump contents of a block ea_list List extended attributes of an inode ea_get Get an extended attribute of an inode ea_set Set an extended attribute of an inode ea_rm Remove an extended attribute of an inode list_quota, lq List quota get_quota, gq Get quota inode_dump, idump, id Dump the inode structure in hex journal_open, jo Open the journal journal_close, jc Close the journal journal_write, jw Write a transaction to the journal journal_run, jr Recover the journal help Display info on command or topic. list_requests, lr, ? List available commands. quit, q Leave the subsystem. debugfs: debugfs: debugfs: debugfs: debugfs: debugfs: debugfs: debugfs: debugfs: debugfs: debugfs: open /dev/sdb1 debugfs: Permission denied while trying to open /dev/sdb1 debugfs: sudo open /dev/sdb1 debugfs: Unknown request "sudo". Type "?" for a request list. debugfs: open /dev/sdb3 debugfs: Permission denied while trying to open /dev/sdb3 debugfs: exit debugfs: Unknown request "exit". Type "?" for a request list. debugfs: quit lubuntu@lubuntu:~$ lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT loop0 7:0 0 1.5G 1 loop /rofs sda 8:0 0 29.8G 0 disk /cdrom ├─sda1 8:1 0 1.6G 0 part └─sda2 8:2 0 3.7M 0 part sdb 8:16 0 465.8G 0 disk ├─sdb1 8:17 0 517.7M 0 part [SWAP] ├─sdb2 8:18 0 15G 0 part └─sdb3 8:19 0 450.3G 0 part sr0 11:0 1 1024M 0 rom zram0 252:0 0 1.3G 0 disk [SWAP] zram1 252:1 0 1.3G 0 disk [SWAP] lubuntu@lubuntu:~$ sudo fsdebug sudo: fsdebug: command not found lubuntu@lubuntu:~$ sudo debugfs debugfs 1.44.6 (5-Mar-2019) debugfs: open /dev/sdb3 debugfs: Bad magic number in super-block while trying to open /dev/sdb3 debugfs: open /dev/sdb1 debugfs: Bad magic number in super-block while trying to open /dev/sdb1 /dev/sdb1 contains a swap file system debugfs: stats stats: Filesystem not open debugfs: stats /dev/sdb3 stats: Usage: show_super_stats [-h] debugfs: stats -h stats: Filesystem not open debugfs: stats -h /dev/sdb3 stats: Usage: show_super_stats [-h] debugfs: show_super_stats -h /dev/sdb3 show_super_stats: Usage: show_super_stats [-h] debugfs: show_super_stats /dev/sdb3 show_super_stats: Usage: show_super_stats [-h] debugfs: help stats debugfs (help): No info directory (null) debugfs: stats -h stats: Filesystem not open debugfs: stats --h stats: invalid option -- '-' stats: Usage: show_super_stats [-h] debugfs: stats --help stats: invalid option -- '-' stats: Usage: show_super_stats [-h] debugfs: dirsearch /dev/sdb3 dirsearch: Filesystem not open debugfs: exit debugfs: Unknown request "exit". Type "?" for a request list. debugfs: quit [...]blockget -n [...] rtblock 100659592 type unknown not expected rtblock 100659593 type unknown not expected rtblock 100659594 type unknown not expected rtblock 100659595 type unknown not expected rtblock 100659596 type unknown not expected rtblock 100659597 type unknown not expected rtblock 100659598 type unknown not expected rtblock 100659599 type unknown not expected rtblock 100659600 type unknown not expected rtblock 100659601 type unknown not expected rtblock 100659602 type unknown not expected rtblock 100659603 type unknown not expected rtblock 100659604 type unknown not expected rtblock 100659605 type unknown not expected rtblock 100659606 type unknown not expected rtblock 100659607 type unknown not expected rtblock 100659608 type unknown not expected rtblock 100659609 type unknown not expected rtblock 100659610 type unknown not expected rtblock 100659611 type unknown not expected rtblock 100659612 type unknown not expected rtblock 100659613 type unknown not expected rtblock 100659614 type unknown not expected rtblock 100659615 type unknown not expected rtblock 100659616 type unknown not expected rtblock 100659617 type unknown not expected rtblock 100659618 type unknown not expected rtblock 100659619 type unknown not expected rtblock 100659620 type unknown not expected rtblock 100659621 type unknown not expected rtblock 100659622 type unknown not expected rtblock 100659623 type unknown not expected rtblock 100659624 type unknown not expected rtblock 100659625 type unknown not expected rtblock 100659626 type unknown not expected rtblock 100659627 type unknown not expected rtblock 100659628 type unknown not expected rtblock 100659629 type unknown not expected rtblock 100659630 type unknown not expected rtblock 100659631 type unknown not expected rtblock 100659632 type unknown not expected rtblock 100659633 type unknown not expected rtblock 100659634 type unknown not expected rtblock 100659635 type unknown not expected rtblock 100659636 type unknown not expected rtblock 100659637 type unknown not expected rtblock 100659638 type unknown not expected rtblock 100659639 type unknown not expected rtblock 100659640 type unknown not expected rtblock 100659641 type unknown not expected rtblock 100659642 type unknown not expected rtblock 100659643 type unknown not expected rtblock 100659644 type unknown not expected rtblock 100659645 type unknown not expected rtblock 100659646 type unknown not expected rtblock 100659647 type unknown not expected rtblock 100659648 type unknown not expected rtblock 100659649 type unknown not expected rtblock 100659650 type unknown not expected rtblock 100659651 type unknown not expected rtblock 100659652 type unknown not expected rtblock 100659653 type unknown not expected rtblock 100659654 type unknown not expected rtblock 100659655 type unknown not expected rtblock 100659656 type unknown not expected rtblock 100659657 type unknown not expected rtblock 100659658 type unknown not expected rtblock 100659659 type unknown not expected rtblock 100659660 type unknown not expected rtblock 100659661 type unknown not expected rtblock 100659662 type unknown not expected rtblock 100659663 type unknown not expected rtblock 100659664 type unknown not expected rtblock 100659665 type unknown not expected rtblock 100659666 type unknown not expected rtblock 100659667 type unknown not expected rtblock 100659668 type unknown not expected rtblock 100659669 type unknown not expected rtblock 100659670 type unknown not expected rtblock 100659671 type unknown not expected rtblock 100659672 type unknown not expected rtblock 100659673 type unknown not expected rtblock 100659674 type unknown not expected rtblock 100659675 type unknown not expected rtblock 100659676 type unknown not expected rtblock 100659677 type unknown not expected rtblock 100659678 type unknown not expected rtblock 100659679 type unknown not expected rtblock 100659680 type unknown not expected rtblock 100659681 type unknown not expected rtblock 100659682 type unknown not expected rtblock 100659683 type unknown not expected rtblock 100659684 type unknown not expected rtblock 100659685 type unknown not expected rtblock 100659686 type unknown not expected rtblock 100659687 type unknown not expected rtblock 100659688 type unknown not expected rtblock 100659689 type unknown not expected rtblock 100659690 type unknown not expected rtblock 100659691 type unknown not expected rtblock 100659692 type unknown not expected rtblock 100659693 type unknown not expected rtblock 100659694 type unknown not expected rtblock 100659695 type unknown not expected rtblock 100659696 type unknown not expected rtblock 100659697 type unknown not expected rtblock 100659698 type unknown not expected rtblock 100659699 type unknown not expected rtblock 100659700 type unknown not expected rtblock 100659701 type unknown not expected rtblock 100659702 type unknown not expected rtblock 100659703 type unknown not expected rtblock 100659704 type unknown not expected rtblock 100659705 type unknown not expected rtblock 100659706 type unknown not expected rtblock 100659707 type unknown not expected rtblock 100659708 type unknown not expected rtblock 100659709 type unknown not expected rtblock 100659710 type unknown not expected rtblock 100659711 type unknown not expected rtblock 100659712 type unknown not expected rtblock 100659713 type unknown not expected rtblock 100659714 type unknown not expected rtblock 100659715 type unknown not expected rtblock 100659716 type unknown not expected rtblock 100659717 type unknown not expected rtblock 100659718 type unknown not expected rtblock 100659719 type unknown not expected rtblock 100659720 type unknown not expected rtblock 100659721 type unknown not expected rtblock 100659722 type unknown not expected rtblock 100659723 type unknown not expected rtblock 100659724 type unknown not expected rtblock 100659725 type unknown not expected rtblock 100659726 type unknown not expected rtblock 100659727 type unknown not expected rtblock 100659728 type unknown not expected rtblock 100659729 type unknown not expected rtblock 100659730 type unknown not expected rtblock 100659731 type unknown not expected rtblock 100659732 type unknown not expected rtblock 100659733 type unknown not expected rtblock 100659734 type unknown not expected rtblock 100659735 type unknown not expected rtblock 100659736 type unknown not expected rtblock 100659737 type unknown not expected rtblock 100659738 type unknown not expected rtblock 100659739 type unknown not expected rtblock 100659740 type unknown not expected rtblock 100659741 type unknown not expected rtblock 100659742 type unknown not expected rtblock 100659743 type unknown not expected rtblock 100659744 type unknown not expected rtblock 100659745 type unknown not expected rtblock 100659746 type unknown not expected rtblock 100659747 type unknown not expected rtblock 100659748 type unknown not expected rtblock 100659749 type unknown not expected rtblock 100659750 type unknown not expected rtblock 100659751 type unknown not expected rtblock 100659752 type unknown not expected rtblock 100659753 type unknown not expected rtblock 100659754 type unknown not expected rtblock 100659755 type unknown not expected rtblock 100659756 type unknown not expected rtblock 100659757 type unknown not expected rtblock 100659758 type unknown not expected rtblock 100659759 type unknown not expected rtblock 100659760 type unknown not expected rtblock 100659761 type unknown not expected rtblock 100659762 type unknown not expected rtblock 100659763 type unknown not expected rtblock 100659764 type unknown not expected rtblock 100659765 type unknown not expected rtblock 100659766 type unknown not expected rtblock 100659767 type unknown not expected rtblock 100659768 type unknown not expected rtblock 100659769 type unknown not expected rtblock 100659770 type unknown not expected rtblock 100659771 type unknown not expected rtblock 100659772 type unknown not expected rtblock 100659773 type unknown not expected rtblock 100659774 type unknown not expected rtblock 100659775 type unknown not expected rtblock 100659776 type unknown not expected rtblock 100659777 type unknown not expected rtblock 100659778 type unknown not expected rtblock 100659779 type unknown not expected rtblock 100659780 type unknown not expected rtblock 100659781 type unknown not expected rtblock 100659782 type unknown not expected rtblock 100659783 type unknown not expected rtblock 100659784 type unknown not expected rtblock 100659785 type unknown not expected rtblock 100659786 type unknown not expected rtblock 100659787 type unknown not expected rtblock 100659788 type unknown not expected rtblock 100659789 type unknown not expected rtblock 100659790 type unknown not expected rtblock 100659791 type unknown not expected rtblock 100659792 type unknown not expected rtblock 100659793 type unknown not expected rtblock 100659794 type unknown not expected rtblock 100659795 type unknown not expected rtblock 100659796 type unknown not expected rtblock 100659797 type unknown not expected rtblock 100659798 type unknown not expected rtblock 100659799 type unknown not expected rtblock 100659800 type unknown not expected rtblock 100659801 type unknown not expected rtblock 100659802 type unknown not expected rtblock 100659803 type unknown not expected rtblock 100659804 type unknown not expected rtblock 100659805 type unknown not expected rtblock 100659806 type unknown not expected rtblock 100659807 type unknown not expected rtblock 100659808 type unknown not expected rtblock 100659809 type unknown not expected rtblock 100659810 type unknown not expected rtblock 100659811 type unknown not expected rtblock 100659812 type unknown not expected rtblock 100659813 type unknown not expected rtblock 100659814 type unknown not expected rtblock 100659815 type unknown not expected rtblock 100659816 type unknown not expected rtblock 100659817 type unknown not expected rtblock 100659818 type unknown not expected rtblock 100659819 type unknown not expected rtblock 100659820 type unknown not expected rtblock 100659821 type unknown not expected rtblock 100659822 type unknown not expected rtblock 100659823 type unknown not expected rtblock 100659824 type unknown not expected rtblock 100659825 type unknown not expected rtblock 100659826 type unknown not expected rtblock 100659827 type unknown not expected rtblock 100659828 type unknown not expected rtblock 100659829 type unknown not expected rtblock 100659830 type unknown not expected rtblock 100659831 type unknown not expected rtblock 100659832 type unknown not expected rtblock 100659833 type unknown not expected rtblock 100659834 type unknown not expected rtblock 100659835 type unknown not expected rtblock 100659836 type unknown not expected rtblock 100659837 type unknown not expected rtblock 100659838 type unknown not expected rtblock 100659839 type unknown not expected rtblock 100659840 type unknown not expected rtblock 100659841 type unknown not expected rtblock 100659842 type unknown not expected rtblock 100659843 type unknown not expected rtblock 100659844 type unknown not expected rtblock 100659845 type unknown not expected rtblock 100659846 type unknown not expected rtblock 100659847 type unknown not expected rtblock 100659848 type unknown not expected rtblock 100659849 type unknown not expected rtblock 100659850 type unknown not expected rtblock 100659851 type unknown not expected rtblock 100659852 type unknown not expected rtblock 100659853 type unknown not expected rtblock 100659854 type unknown not expected rtblock 100659855 type unknown not expected rtblock 100659856 type unknown not expected rtblock 100659857 type unknown not expected rtblock 100659858 type unknown not expected rtblock 100659859 type unknown not expected rtblock 100659860 type unknown not expected rtblock 100659861 type unknown not expected rtblock 100659862 type unknown not expected rtblock 100659863 type unknown not expected rtblock 100659864 type unknown not expected rtblock 100659865 type unknown not expected rtblock 100659866 type unknown not expected rtblock 100659867 type unknown not expected rtblock 100659868 type unknown not expected rtblock 100659869 type unknown not expected rtblock 100659870 type unknown not expected rtblock 100659871 type unknown not expected rtblock 100659872 type unknown not expected rtblock 100659873 type unknown not expected rtblock 100659874 type unknown not expected rtblock 100659875 type unknown not expected rtblock 100659876 type unknown not expected rtblock 100659877 type unknown not expected rtblock 100659878 type unknown not expected rtblock 100659879 type unknown not expected rtblock 100659880 type unknown not expected rtblock 100659881 type unknown not expected rtblock 100659882 type unknown not expected rtblock 100659883 type unknown not expected rtblock 100659884 type unknown not expected rtblock 100659885 type unknown not expected rtblock 100659886 type unknown not expected rtblock 100659887 type unknown not expected rtblock 100659888 type unknown not expected rtblock 100659889 type unknown not expected rtblock 100659890 type unknown not expected rtblock 100659891 type unknown not expected rtblock 100659892 type unknown not expected rtblock 100659893 type unknown not expected rtblock 100659894 type unknown not expected rtblock 100659895 type unknown not expected rtblock 100659896 type unknown not expected rtblock 100659897 type unknown not expected rtblock 100659898 type unknown not expected rtblock 100659899 type unknown not expected rtblock 100659900 type unknown not expected rtblock 100659901 type unknown not expected rtblock 100659902 type unknown not expected rtblock 100659903 type unknown not expected rtblock 100659904 type unknown not expected rtblock 100659905 type unknown not expected rtblock 100659906 type unknown not expected rtblock 100659907 type unknown not expected rtblock 100659908 type unknown not expected rtblock 100659909 type unknown not expected rtblock 100659910 type unknown not expected rtblock 100659911 type unknown not expected rtblock 100659912 type unknown not expected rtblock 100659913 type unknown not expected rtblock 100659914 type unknown not expected rtblock 100659915 type unknown not expected rtblock 100659916 type unknown not expected rtblock 100659917 type unknown not expected rtblock 100659918 type unknown not expected rtblock 100659919 type unknown not expected rtblock 100659920 type unknown not expected rtblock 100659921 type unknown not expected rtblock 100659922 type unknown not expected rtblock 100659923 type unknown not expected rtblock 100659924 type unknown not expected rtblock 100659925 type unknown not expected rtblock 100659926 type unknown not expected rtblock 100659927 type unknown not expected rtblock 100659928 type unknown not expected rtblock 100659929 type unknown not expected rtblock 100659930 type unknown not expected rtblock 100659931 type unknown not expected rtblock 100659932 type unknown not expected rtblock 100659933 type unknown not expected rtblock 100659934 type unknown not expected rtblock 100659935 type unknown not expected rtblock 100659936 type unknown not expected rtblock 100659937 type unknown not expected rtblock 100659938 type unknown not expected rtblock 100659939 type unknown not expected rtblock 100659940 type unknown not expected rtblock 100659941 type unknown not expected rtblock 100659942 type unknown not expected rtblock 100659943 type unknown not expected rtblock 100659944 type unknown not expected rtblock 100659945 type unknown not expected rtblock 100659946 type unknown not expected rtblock 100659947 type unknown not expected rtblock 100659948 type unknown not expected rtblock 100659949 type unknown not expected rtblock 100659950 type unknown not expected rtblock 100659951 type unknown not expected rtblock 100659952 type unknown not expected rtblock 100659953 type unknown not expected rtblock 100659954 type unknown not expected rtblock 100659955 type unknown not expected rtblock 100659956 type unknown not expected rtblock 100659957 type unknown not expected rtblock 100659958 type unknown not expected rtblock 100659959 type unknown not expected rtblock 100659960 type unknown not expected rtblock 100659961 type unknown not expected rtblock 100659962 type unknown not expected rtblock 100659963 type unknown not expected rtblock 100659964 type unknown not expected rtblock 100659965 type unknown not expected rtblock 100659966 type unknown not expected rtblock 100659967 type unknown not expected rt summary mismatch, size 0 block 9, file: -1040121856, computed: 0 rt summary mismatch, size 0 block 10, file: 1359216640, computed: 1901 rt summary mismatch, size 0 block 11, file: 1459748864, computed: 230 rt summary mismatch, size 1 block 9, file: 1644232704, computed: 0 rt summary mismatch, size 1 block 10, file: 1845821440, computed: 1967 rt summary mismatch, size 1 block 11, file: 453181440, computed: 477 rt summary mismatch, size 2 block 9, file: 218103808, computed: 0 rt summary mismatch, size 2 block 10, file: -251592704, computed: 983 rt summary mismatch, size 2 block 11, file: 352387072, computed: 221 rt summary mismatch, size 3 block 9, file: 234881024, computed: 0 rt summary mismatch, size 3 block 10, file: -570425344, computed: 359 rt summary mismatch, size 3 block 11, file: -1291845632, computed: 80 rt summary mismatch, size 4 block 9, file: 67108864, computed: 0 rt summary mismatch, size 4 block 10, file: 771751936, computed: 66 rt summary mismatch, size 4 block 11, file: 838860800, computed: 18 rt summary mismatch, size 5 block 9, file: 33554432, computed: 0 rt summary mismatch, size 5 block 10, file: 100663296, computed: 2 rt summary mismatch, size 5 block 11, file: 100663296, computed: 0 rt summary mismatch, size 6 block 10, file: 0, computed: 3 rt summary mismatch, size 16 block 11, file: 16777216, computed: 1 sb_frextents 93792, counted 88394 xfs_db> ncheck -i 1260408 1260408 network/apg_data/extgdb_objs_go_hd/0000078b/extgdb_go_0078b479 xfs_db> ncheck -i 14025 14025 viewer/segments/Rcrd-03-18-2015-1027-08-10405-ch501-min65535-src2.mpg/0000000006023020544 xfs_db> help ablock filoff -- set address to file offset (attr fork) addr [field-expression] -- set current address agf [agno] -- set address to agf header agfl [agno] -- set address to agfl block agi [agno] -- set address to agi header back -- move to the previous location in the position ring blockfree -- free block usage information blockget [-s|-v] [-n] [-t] [-b bno]... [-i ino] ... -- get block usage and check consistency blockuse [-n] [-c blockcount] -- print usage for current block(s) bmap [-ad] [block [len]] -- show block map for current file convert type num [type num]... type -- convert from one address form to another daddr [d] -- set address to daddr value dblock filoff -- set address to file offset (data fork) debug [flagbits] -- set debug option bits dquot [projid|gid|uid] -- set current address to project, group or user quota block echo [args]... -- echo arguments forward -- move forward to next entry in the position ring frag [-a] [-d] [-f] [-l] [-q] [-R] [-r] [-v] -- get file fragmentation data freesp [-bcdfs] [-a agno]... [-e binsize] [-h h1]... [-m binmult] -- summarize free space for filesystem fsblock [fsb] -- set address to fsblock value hash string -- calculate hash value help [command] -- help for one or all commands inode [inode#] -- set current inode label [label] -- write/print FS label log [stop|start ] -- start or stop logging to a file metadump [-e] [-g] [-m max_extent] [-w] [-o] filename -- dump metadata to a file ncheck [-s] [-i ino] ... -- print inode-name pairs pop -- pop location from the stack print [value]... -- print field values push [command] -- push location to the stack quit -- exit xfs_db ring -- show position ring or move to a specific entry sb [agno] -- set current address to sb header source source-file -- get commands from source-file stack -- view the location stack type [newtype] -- set/show current data type uuid [uuid] -- write/print FS uuid version [feature | [vnum fnum]] -- set feature bit(s) in the sb version field Use 'help commandname' for extended help. xfs_db> stack xfs_db> help stack stack -- view the location stack The stack is used to explicitly store your location and data type for later return. The 'push' operation stores the current address and type on the stack, the 'pop' operation returns you to the position and datatype of the top entry on the stack. The 'stack' allows explicit location saves, see 'ring' for implicit position tracking. xfs_db> ring no entries in location ring. xfs_db> help ring ring -- show position ring or move to a specific entry The position ring automatically keeps track of each disk location and structure type for each change of position you make during your xfs_db session. The last 20 most recent entries are kept in the ring. To display the current list of ring entries type 'ring' by itself on the command line. The entry highlighted by an asterisk ('*') is the current entry. To move to another entry in the ring type 'ring ' where is your desired entry from the ring position list. You may also use the 'forward' ('f') or 'back' ('b') commands to move to the previous or next entry in the ring, respectively. Note: Unlike the 'stack', 'push' and 'pop' commands, the ring tracks your location implicitly. Use the 'push' and 'pop' commands if you wish to store a specific location explicitly for later return. xfs_db> forward ring is empty xfs_db> blockget -i 14025 already have block usage information xfs_db> inode 14025 xfs_db> help inode inode [inode#] -- set current inode xfs_db> help ablock ablock filoff -- set address to file offset (attr fork) Example: 'ablock 23' - sets the file position to the 23rd filesystem block in the inode's attribute fork. The filesystem block size is specified in the superblock. xfs_db> ablock 3 no attribute data for file xfs_db> ablock 14025 no attribute data for file xfs_db> ablock 1 no attribute data for file xfs_db> ablock 2 no attribute data for file xfs_db> ablock 3 no attribute data for file xfs_db> ablock 4 no attribute data for file xfs_db> ablock 5 no attribute data for file xfs_db> bmap data offset 0 startblock 19829760 (75/168960) count 256 flag 0 data offset 256 startblock 19842816 (75/182016) count 256 flag 0 data offset 512 startblock 23245056 (88/176384) count 512 flag 0 data offset 1024 startblock 19879936 (75/219136) count 256 flag 0 data offset 1280 startblock 23251968 (88/183296) count 768 flag 0 data offset 2048 startblock 23259136 (88/190464) count 512 flag 0 data offset 2560 startblock 26080512 (99/128256) count 256 flag 0 data offset 2816 startblock 26139136 (99/186880) count 512 flag 0 data offset 3328 startblock 26095872 (99/143616) count 256 flag 0 data offset 3584 startblock 26101760 (99/149504) count 256 flag 0 data offset 3840 startblock 26107136 (99/154880) count 256 flag 0 xfs_db> inode 14059 xfs_db> bmap data offset 0 startblock 23444992 (89/114176) count 512 flag 0 data offset 512 startblock 20478208 (78/30976) count 256 flag 0 data offset 768 startblock 23446528 (89/115712) count 512 flag 0 data offset 1280 startblock 20491520 (78/44288) count 256 flag 0 data offset 1536 startblock 23454720 (89/123904) count 512 flag 0 data offset 2048 startblock 20499456 (78/52224) count 256 flag 0 data offset 2304 startblock 20501248 (78/54016) count 256 flag 0 data offset 2560 startblock 23468032 (89/137216) count 256 flag 0 data offset 2816 startblock 26375168 (100/160768) count 256 flag 0 data offset 3072 startblock 26377728 (100/163328) count 256 flag 0 data offset 3328 startblock 26471936 (100/257536) count 512 flag 0 data offset 3840 startblock 26401536 (100/187136) count 256 flag 0 xfs_db> help bmap bmap [-ad] [block [len]] -- show block map for current file xfs_db> bmap -a xfs_db> bmap -d data offset 0 startblock 23444992 (89/114176) count 512 flag 0 data offset 512 startblock 20478208 (78/30976) count 256 flag 0 data offset 768 startblock 23446528 (89/115712) count 512 flag 0 data offset 1280 startblock 20491520 (78/44288) count 256 flag 0 data offset 1536 startblock 23454720 (89/123904) count 512 flag 0 data offset 2048 startblock 20499456 (78/52224) count 256 flag 0 data offset 2304 startblock 20501248 (78/54016) count 256 flag 0 data offset 2560 startblock 23468032 (89/137216) count 256 flag 0 data offset 2816 startblock 26375168 (100/160768) count 256 flag 0 data offset 3072 startblock 26377728 (100/163328) count 256 flag 0 data offset 3328 startblock 26471936 (100/257536) count 512 flag 0 data offset 3840 startblock 26401536 (100/187136) count 256 flag 0 xfs_db> bmap -v bmap: invalid option -- 'v' bad option for bmap command xfs_db> inode 133 xfs_db> bmap data offset 0 startblock 609 (0/609) count 1 flag 0 xfs_db> exit command exit not found xfs_db> quit lubuntu@lubuntu:~/Documents$ sudo fdisk -l Disk /dev/loop0: 1.5 GiB, 1589342208 bytes, 3104184 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disk /dev/sda: 29.8 GiB, 32015679488 bytes, 62530624 sectors Disk model: Cruzer Glide Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: dos Disk identifier: 0x0f9be39a Device Boot Start End Sectors Size Id Type /dev/sda1 * 0 3237695 3237696 1.6G 0 Empty /dev/sda2 3211356 3218843 7488 3.7M ef EFI (FAT-12/16/32) Disk /dev/sdb: 465.8 GiB, 500107862016 bytes, 976773168 sectors Disk model: WDC WD5000AVVS-6 Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: dos Disk identifier: 0x00000000 Device Boot Start End Sectors Size Id Type /dev/sdb1 64 1060289 1060226 517.7M 82 Linux swap / Solaris /dev/sdb2 1060296 32531624 31471329 15G 83 Linux /dev/sdb3 32531632 976768064 944236433 450.3G 83 Linux Disk /dev/zram0: 1.3 GiB, 1421402112 bytes, 347022 sectors Units: sectors of 1 * 4096 = 4096 bytes Sector size (logical/physical): 4096 bytes / 4096 bytes I/O size (minimum/optimal): 4096 bytes / 4096 bytes Disk /dev/zram1: 1.3 GiB, 1421402112 bytes, 347022 sectors Units: sectors of 1 * 4096 = 4096 bytes Sector size (logical/physical): 4096 bytes / 4096 bytes I/O size (minimum/optimal): 4096 bytes / 4096 bytes lubuntu@lubuntu:~/Documents$ echo data offset 0 startblock 609 (0/609) count 1 flag 0 bash: syntax error near unexpected token `(' lubuntu@lubuntu:~/Documents$ dd if=/dev/sdb2 of=test bs=512 skip 609 count=1 dd: unrecognized operand ‘skip’ Try 'dd --help' for more information. lubuntu@lubuntu:~/Documents$ dd if=/dev/sdb2 of=test bs=512 skip=609 count=1 dd: failed to open '/dev/sdb2': Permission denied lubuntu@lubuntu:~/Documents$ sudo dd if=/dev/sdb2 of=test bs=512 skip=609 count=1 1+0 records in 1+0 records out 512 bytes copied, 0.000376168 s, 1.4 MB/s lubuntu@lubuntu:~/Documents$ cat test T� T� T� T� U UzU\Uf U� U� U� U� U� U� U� U� V V VVV� V& V�V� V� V� V� WW▒ W' W6 WF WVW�W�W� X X- X? XN X] Xn X} Y X� YY# YxY|Y� Y�Y�Y� Y� Z ZNZT Z% Zd Zu Z�lubuntu@lubuntu:~/Documents$ sudo dd if=/dev/sdb2 of=test bs=512 skip=608 count=1 1+0 records in 1+0 records out 512 bytes copied, 0.000282161 s, 1.8 MB/s lubuntu@lubuntu:~/Documents$ cat test ABTB�E����Oa O� O�O� O� O� PFP[ Pi Pz P� P� P� P� P�Q Q Q QWQ] Q. Qm Q� Q� Q� Q�Q� Q� R RR R- RRRw R� R� R�R� R� R� R� S S) S SiS7 S} S� S� S�S� TWTj T Ty T� T� T� T�lubuntu@lubuntu:~/Documents$ ls -liah total 4.0K 26214 drwxr-xr-x 2 lubuntu lubuntu 60 May 31 20:29 . 25564 drwxr-xr-x 15 lubuntu lubuntu 420 May 31 19:52 .. 431 -rw-r--r-- 1 root root 512 May 31 20:29 test lubuntu@lubuntu:~/Documents$ sudo blockdev --getbsz /dev/sdb2 512 lubuntu@lubuntu:~/Documents$ sudo xfs_info /dev/sdb2 xfs_info: /dev/sdb2 is not a mounted XFS filesystem lubuntu@lubuntu:~/Documents$ echo data offset 0 startblock 609 count 1 flag 0 data offset 0 startblock 609 count 1 flag 0 lubuntu@lubuntu:~/Documents$ sudo dd if=/dev/sdb2 of=test bs=512 skip=609 count=1 1+0 records in 1+0 records out 512 bytes copied, 0.00038818 s, 1.3 MB/s lubuntu@lubuntu:~/Documents$ xxd test 00000000: 0001 54ca 0000 000b 0001 54db 0000 000a ..T.......T..... 00000010: 0001 54e9 0000 000c 0001 54f9 0000 000c ..T.......T..... 00000020: 0001 550a 0000 000b 0001 5520 0000 000d ..U.......U .... 00000030: 0001 553d 0000 000f 0001 555c 0000 0007 ..U=......U\.... 00000040: 0001 5566 0000 000d 0001 557a 0000 0009 ..Uf......Uz.... 00000050: 0001 5588 0000 000b 0001 5597 0000 000c ..U.......U..... 00000060: 0001 55a8 0000 000b 0001 55b7 0000 000c ..U.......U..... 00000070: 0001 55c8 0000 000b 0001 55d8 0000 000b ..U.......U..... 00000080: 0001 55e7 0000 000c 0001 55f7 0000 000c ..U.......U..... 00000090: 0001 5607 0000 000c 0001 5617 0000 000c ..V.......V..... 000000a0: 0001 5626 0000 000d 0001 5642 0000 000d ..V&......VB.... 000000b0: 0001 5656 0000 000e 0001 5680 0000 000b ..VV......V..... 000000c0: 0001 5696 0000 0002 0001 569c 0000 000c ..V.......V..... 000000d0: 0001 56ac 0000 000c 0001 56c0 0000 000c ..V.......V..... 000000e0: 0001 56f7 0000 000b 0001 5704 0000 000e ..V.......W..... 000000f0: 0001 5718 0000 000a 0001 5727 0000 000b ..W.......W'.... 00000100: 0001 5736 0000 000c 0001 5746 0000 000c ..W6......WF.... 00000110: 0001 5756 0000 0005 0001 5794 0000 0007 ..WV......W..... 00000120: 0001 579d 0000 000e 0001 57d0 0000 000b ..W.......W..... 00000130: 0001 580a 0000 000f 0001 581b 0000 000e ..X.......X..... 00000140: 0001 582d 0000 000c 0001 583f 0000 000a ..X-......X?.... 00000150: 0001 584e 0000 000b 0001 585d 0000 000c ..XN......X].... 00000160: 0001 586e 0000 000b 0001 587d 0000 000c ..Xn......X}.... 00000170: 0001 588c 0000 000d 0001 590a 0000 0004 ..X.......Y..... 00000180: 0001 5910 0000 000e 0001 5923 0000 000b ..Y.......Y#.... 00000190: 0001 5978 0000 0002 0001 597c 0000 0002 ..Yx......Y|.... 000001a0: 0001 5982 0000 000c 0001 59c1 0000 000f ..Y.......Y..... 000001b0: 0001 59db 0000 0005 0001 59e5 0000 000b ..Y.......Y..... 000001c0: 0001 59f5 0000 000b 0001 5a04 0000 000c ..Y.......Z..... 000001d0: 0001 5a25 0000 000d 0001 5a4e 0000 0001 ..Z%......ZN.... 000001e0: 0001 5a54 0000 000b 0001 5a64 0000 000b ..ZT......Zd.... 000001f0: 0001 5a75 0000 000a 0001 5a81 0000 000e ..Zu......Z..... lubuntu@lubuntu:~/Documents$ xfs_db Usage: xfs_db [-ifFrxV] [-p prog] [-l logdev] [-c cmd]... device lubuntu@lubuntu:~/Documents$ xfs_db /dev/sdb2 xfs_db: cannot open /dev/sdb2: Permission denied lubuntu@lubuntu:~/Documents$ sudo xfs_db /dev/sdb2 xfs_db> help ablock filoff -- set address to file offset (attr fork) addr [field-expression] -- set current address agf [agno] -- set address to agf header agfl [agno] -- set address to agfl block agi [agno] -- set address to agi header back -- move to the previous location in the position ring blockfree -- free block usage information blockget [-s|-v] [-n] [-t] [-b bno]... [-i ino] ... -- get block usage and check consistency blockuse [-n] [-c blockcount] -- print usage for current block(s) bmap [-ad] [block [len]] -- show block map for current file convert type num [type num]... type -- convert from one address form to another daddr [d] -- set address to daddr value dblock filoff -- set address to file offset (data fork) debug [flagbits] -- set debug option bits dquot [projid|gid|uid] -- set current address to project, group or user quota block echo [args]... -- echo arguments forward -- move forward to next entry in the position ring frag [-a] [-d] [-f] [-l] [-q] [-R] [-r] [-v] -- get file fragmentation data freesp [-bcdfs] [-a agno]... [-e binsize] [-h h1]... [-m binmult] -- summarize free space for filesystem fsblock [fsb] -- set address to fsblock value hash string -- calculate hash value help [command] -- help for one or all commands inode [inode#] -- set current inode label [label] -- write/print FS label log [stop|start ] -- start or stop logging to a file metadump [-e] [-g] [-m max_extent] [-w] [-o] filename -- dump metadata to a file ncheck [-s] [-i ino] ... -- print inode-name pairs pop -- pop location from the stack print [value]... -- print field values push [command] -- push location to the stack quit -- exit xfs_db ring -- show position ring or move to a specific entry sb [agno] -- set current address to sb header source source-file -- get commands from source-file stack -- view the location stack type [newtype] -- set/show current data type uuid [uuid] -- write/print FS uuid version [feature | [vnum fnum]] -- set feature bit(s) in the sb version field Use 'help commandname' for extended help. xfs_db> inode 179 xfs_db> bmap data offset 0 startblock 24926 (0/24926) count 31 flag 0 xfs_db> exit command exit not found xfs_db> quit lubuntu@lubuntu:~/Documents$ sudo dd if=/dev/sdb2 of=test bs=512 skip=24926 count=31 31+0 records in 31+0 records out 15872 bytes (16 kB, 16 KiB) copied, 0.0177817 s, 893 kB/s lubuntu@lubuntu:~/Documents$ vim test lubuntu@lubuntu:~/Documents$ sudo dd if=/dev/sdb2 of=test bs=512 skip=24925 count=31 31+0 records in 31+0 records out 15872 bytes (16 kB, 16 KiB) copied, 0.0197572 s, 803 kB/s lubuntu@lubuntu:~/Documents$ vim test lubuntu@lubuntu:~/Documents$ xfs_db /dev/sdb2 xfs_db: cannot open /dev/sdb2: Permission denied lubuntu@lubuntu:~/Documents$ sudo xfs_db /dev/sdb2 xfs_db> inode 63051287 xfs_db> bmap data offset 0 startblock 14146560 (53/252928) count 256 flag 0 data offset 256 startblock 14155520 (53/261888) count 256 flag 0 data offset 512 startblock 14196992 (54/41216) count 256 flag 0 data offset 768 startblock 14211840 (54/56064) count 256 flag 0 data offset 1024 startblock 14216192 (54/60416) count 256 flag 0 data offset 1280 startblock 14219008 (54/63232) count 256 flag 0 data offset 1536 startblock 14239488 (54/83712) count 256 flag 0 data offset 1792 startblock 14245376 (54/89600) count 256 flag 0 data offset 2048 startblock 16124672 (61/133888) count 512 flag 0 data offset 2560 startblock 14286592 (54/130816) count 256 flag 0 data offset 2816 startblock 16135680 (61/144896) count 256 flag 0 data offset 3072 startblock 16140544 (61/149760) count 512 flag 0 data offset 3584 startblock 14306560 (54/150784) count 256 flag 0 data offset 3840 startblock 14364160 (54/208384) count 256 flag 0 xfs_db> exit command exit not found xfs_db> quit lubuntu@lubuntu:~/Documents$ xfs_repair --help xfs_repair: invalid option -- '-' Usage: xfs_repair [options] device Options: -f The device is a file -L Force log zeroing. Do this as a last resort. -l logdev Specifies the device where the external log resides. -m maxmem Maximum amount of memory to be used in megabytes. -n No modify mode, just checks the filesystem for damage. -P Disables prefetching. -r rtdev Specifies the device where the realtime section resides. -v Verbose output. -c subopts Change filesystem parameters - use xfs_admin. -o subopts Override default behaviour, refer to man page. -t interval Reporting interval in seconds. -d Repair dangerously. -V Reports version and exits. lubuntu@lubuntu:~/Documents$ xfs_repair -v -n /dev/sdb2 xfs_repair: cannot open /dev/sdb2: Permission denied lubuntu@lubuntu:~/Documents$ sudo xfs_repair -v -n /dev/sdb2 Phase 1 - find and verify superblock... xfs_repair: filesystem has a realtime subvolume xfs_repair: realtime device init failed xfs_repair: cannot repair this filesystem. Sorry. lubuntu@lubuntu:~/Documents$ sudo xfs_repair -v -n -d /dev/sdb2 Phase 1 - find and verify superblock... xfs_repair: filesystem has a realtime subvolume xfs_repair: realtime device init failed xfs_repair: cannot repair this filesystem. Sorry. lubuntu@lubuntu:~/Documents$ sudo xfs_repair -v -d /dev/sdb2 Phase 1 - find and verify superblock... xfs_repair: filesystem has a realtime subvolume xfs_repair: realtime device init failed xfs_repair: cannot repair this filesystem. Sorry. lubuntu@lubuntu:~/Documents$ sudo xfs_repair -v -n -o /dev/sdb2 unknown option -o /dev/sdb2 Usage: xfs_repair [options] device Options: -f The device is a file -L Force log zeroing. Do this as a last resort. -l logdev Specifies the device where the external log resides. -m maxmem Maximum amount of memory to be used in megabytes. -n No modify mode, just checks the filesystem for damage. -P Disables prefetching. -r rtdev Specifies the device where the realtime section resides. -v Verbose output. -c subopts Change filesystem parameters - use xfs_admin. -o subopts Override default behaviour, refer to man page. -t interval Reporting interval in seconds. -d Repair dangerously. -V Reports version and exits. lubuntu@lubuntu:~/Documents$ sudo xfs_repair -v -n -o subopts /dev/sdb2 unknown option -o subopts Usage: xfs_repair [options] device Options: -f The device is a file -L Force log zeroing. Do this as a last resort. -l logdev Specifies the device where the external log resides. -m maxmem Maximum amount of memory to be used in megabytes. -n No modify mode, just checks the filesystem for damage. -P Disables prefetching. -r rtdev Specifies the device where the realtime section resides. -v Verbose output. -c subopts Change filesystem parameters - use xfs_admin. -o subopts Override default behaviour, refer to man page. -t interval Reporting interval in seconds. -d Repair dangerously. -V Reports version and exits. lubuntu@lubuntu:~/Documents$ sudo xfs_repair -v -o subopts /dev/sdb2 unknown option -o subopts Usage: xfs_repair [options] device Options: -f The device is a file -L Force log zeroing. Do this as a last resort. -l logdev Specifies the device where the external log resides. -m maxmem Maximum amount of memory to be used in megabytes. -n No modify mode, just checks the filesystem for damage. -P Disables prefetching. -r rtdev Specifies the device where the realtime section resides. -v Verbose output. -c subopts Change filesystem parameters - use xfs_admin. -o subopts Override default behaviour, refer to man page. -t interval Reporting interval in seconds. -d Repair dangerously. -V Reports version and exits. lubuntu@lubuntu:~/Documents$ sudo xfs_repair -o subopts /dev/sdb2 unknown option -o subopts Usage: xfs_repair [options] device Options: -f The device is a file -L Force log zeroing. Do this as a last resort. -l logdev Specifies the device where the external log resides. -m maxmem Maximum amount of memory to be used in megabytes. -n No modify mode, just checks the filesystem for damage. -P Disables prefetching. -r rtdev Specifies the device where the realtime section resides. -v Verbose output. -c subopts Change filesystem parameters - use xfs_admin. -o subopts Override default behaviour, refer to man page. -t interval Reporting interval in seconds. -d Repair dangerously. -V Reports version and exits. lubuntu@lubuntu:~/Documents$ sudo xfs_repair -d /dev/sdb2 Phase 1 - find and verify superblock... xfs_repair: filesystem has a realtime subvolume xfs_repair: realtime device init failed xfs_repair: cannot repair this filesystem. Sorry. lubuntu@lubuntu:~/Documents$ xfs_repair -L /dev/sdb2 xfs_repair: cannot open /dev/sdb2: Permission denied lubuntu@lubuntu:~/Documents$ sudo xfs_repair -L /dev/sdb2 Phase 1 - find and verify superblock... xfs_repair: filesystem has a realtime subvolume xfs_repair: realtime device init failed xfs_repair: cannot repair this filesystem. Sorry. lubuntu@lubuntu:~/Documents$ xfsdump Command 'xfsdump' not found, but can be installed with: sudo apt install xfsdump lubuntu@lubuntu:~/Documents$ sudo xfs_db /dev/sdb2 xfs_db> help ablock filoff -- set address to file offset (attr fork) addr [field-expression] -- set current address agf [agno] -- set address to agf header agfl [agno] -- set address to agfl block agi [agno] -- set address to agi header back -- move to the previous location in the position ring blockfree -- free block usage information blockget [-s|-v] [-n] [-t] [-b bno]... [-i ino] ... -- get block usage and check consistency blockuse [-n] [-c blockcount] -- print usage for current block(s) bmap [-ad] [block [len]] -- show block map for current file convert type num [type num]... type -- convert from one address form to another daddr [d] -- set address to daddr value dblock filoff -- set address to file offset (data fork) debug [flagbits] -- set debug option bits dquot [projid|gid|uid] -- set current address to project, group or user quota block echo [args]... -- echo arguments forward -- move forward to next entry in the position ring frag [-a] [-d] [-f] [-l] [-q] [-R] [-r] [-v] -- get file fragmentation data freesp [-bcdfs] [-a agno]... [-e binsize] [-h h1]... [-m binmult] -- summarize free space for filesystem fsblock [fsb] -- set address to fsblock value hash string -- calculate hash value help [command] -- help for one or all commands inode [inode#] -- set current inode label [label] -- write/print FS label log [stop|start ] -- start or stop logging to a file metadump [-e] [-g] [-m max_extent] [-w] [-o] filename -- dump metadata to a file ncheck [-s] [-i ino] ... -- print inode-name pairs pop -- pop location from the stack print [value]... -- print field values push [command] -- push location to the stack quit -- exit xfs_db ring -- show position ring or move to a specific entry sb [agno] -- set current address to sb header source source-file -- get commands from source-file stack -- view the location stack type [newtype] -- set/show current data type uuid [uuid] -- write/print FS uuid version [feature | [vnum fnum]] -- set feature bit(s) in the sb version field Use 'help commandname' for extended help. xfs_db> print no current type xfs_db> help agf agf [agno] -- set address to agf header set allocation group free block list Example: agf 2 - move location to AGF in 2nd filesystem allocation group Located in the second sector of each allocation group, the AGF contains the root of two different freespace btrees: The 'cnt' btree keeps track freespace indexed on section size. The 'bno' btree tracks sections of freespace indexed on block number. xfs_db> agf 2 xfs_db> help debug debug [flagbits] -- set debug option bits xfs_db> debug debug = 0 xfs_db> debug -1 debug = -1 xfs_db> debug 9 debug = 9 xfs_db> debug 0 debug = 0 xfs_db> dblock filoff bad block number filoff xfs_db> dblock 24926 bad inode number -1 no type for file data xfs_db> dblock 133 bad inode number -1 no type for file data xfs_db> fsblock 133 xfs_db> blockuse must run blockget first xfs_db> inode 382285 xfs_db> blockuse must run blockget first xfs_db> blockget [...] sudo binwalk -e -y="PNG" /dev/sdb3 sudo binwalk --dd=.png -y="PNG" /dev/sdb3 244575999 0xE93EEFF PNG image, 192 x 20, 8-bit colormap, non-interlaced 244582882 0xE9409E2 PNG image, 203 x 26, 8-bit colormap, non-interlaced