debugfs
interactive debugger for ext2/ext3/ext4 filesystems
TLDR
Open filesystem in read-only mode
$ debugfs [/dev/sdXN]
Open filesystem in read-write mode$ debugfs -w [/dev/sdXN]
Read commands from file$ debugfs -f [path/to/cmd_file] [/dev/sdXN]
Execute a single command and exit$ debugfs -R "stats" [/dev/sdXN]
List deleted inodes (interactive)$ lsdel
Recover a deleted inode to a file (interactive)$ dump <[inode_number]> [/path/to/output]
SYNOPSIS
debugfs [options] [device]
DESCRIPTION
debugfs is an interactive debugger for ext2/ext3/ext4 filesystems. It allows direct manipulation of filesystem structures, which is useful for data recovery, analysis, and troubleshooting.Can be used to recover deleted files, examine inodes, and manually fix filesystem issues.
PARAMETERS
-w
Open in read-write mode (default is read-only)-c
Open in catastrophic mode (inode and group bitmaps not read initially, forces read-only)-n
Disable metadata checksum verification-f cmdfile_
Read and execute commands from file, then exit-R request
Execute a single command and exit-b blocksize
Force a specific block size in bytes instead of auto-detecting-s superblock
Read superblock from the given block number (requires -b)-i
Treat device as an ext2 image file created by e2image-D
Open device using Direct I/O, bypassing the buffer cache-z undofile_
Write old block contents to an undo file before overwriting (for use with e2undo)
INTERACTIVE COMMANDS
stats
Show filesystem statisticsls dir
List directory contentscat file
Display file contentslsdel
List deleted inodesundel <inode> [pathname]
Undelete inode and optionally link to pathnamedump inode file
Dump inode contents to a filencheck inode
Translate inode numbers to pathnamesicheck block
Translate block numbers to inodeslogdump
Dump ext3/ext4 journal contents
CAVEATS
Requires root privileges. Use with extreme caution in write mode. Unmount filesystem before making changes. Improper use can cause data loss.
