Hey guys and welcome back. Now in the previous nugget we discussed some of the tools that
we have available to us to work with EXT based file systems. Now we do have a few more tools
that we want to discuss with respect to EXT and those happen to be one called dump E2FS and
another one called debug FS. So let's begin exploring what these two commands can bring us.
So we will start with the very first one dump E2FS. Now quite honestly this command can give you a
massive volume of information quite honestly it can be a little bit too much at least in my opinion
so just be wary of the output of this particular command. Now much of what you're going to see
in this output is going to be related to what are called block group descriptors. Now you can see this
information and in some cases this is definitely a useful piece of information to see of course
but quite honestly generally speaking you're not going to be utilizing this information. Now if you
want to be able to omit this information and quite honestly shorten out the input by a great deal
make it much more readable you can use the dump E2FS command with the dash H option. In fact if we
go into the man page dump E2FS you can see what it's going to do is only display the super block
information and not these block descriptors. So that is what we will do press Q to quit
let's just clear the screen and we can perhaps run it against SDB1 because like we know this is an
EXT based file system so I will say SIDO Dump E2FS and using that dash H flag I will target
DEV SDB1. So if I enter I have to type in my passwords there we go now we're going to get this
information here so this is like the information we see from the listing of tune to FS whereas if we
do not use the H flag you'll get to see what I mean. Hit enter we see way way way more information
this way okay so realistically you're probably not going to need all of this information on a
regular basis at least so we will stick to the dash H flag. Now some pieces of information that we
want to be aware of is say for example this one right here the file system features now the reason
why this is useful is this is going to allow you to see what your file system can actually do for
example we can see here that we have the has journal option this means that this file system
is capable of journaling now you may remember that EXT2 does not have journaling this was brought in
on EXT3 and carried forward on EXT4 so the fact that we have an EXT4 based file system no surprise
to learn that this file system does indeed have the ability to journal but despite this even if we
did not know that information we could easily find this information out using this particular command
now that is only one piece of information we would want to be aware of now another very useful piece
of information relates to our inodes and it's this one right here the inode count simply put on
linux every file must have an inode number and this value here tells us how many inodes are
available on the system and if every file must have an inode number in essence this value tells us
the maximum amount of files that you can have on your system now we actually have our block count
this tells us the amount of blocks we have available on the system and the reserve block counts this
is how many blocks are reserved for the super user now we did mention it is unlikely that you would
want to see the entire output of this command i.e the output containing those block group descriptors
but actually when you happen to be using the Fisk utility when you want to repair a particular
file system you may get a very peculiar error denoting that you have something called a bad
super block now this is not something you're going to be dealing with with any kind of regularity
but when you want to be able to invoke backups of your information you can actually take the block
group descriptor information say for example here if i run the command again without the hflag
let's have a look at group one right here notice we can actually see the backup super block location
and the value here is three two seven six eight now if your super block happens to be corrupted
and you have some type of error you could actually use this information with Fisk so you would take
in notes of the value here and we would take a note of what we are targeting in this case here
it's sdb1 and all i could do here is i could use the command fisk dash b and then specify that block
value and then specify what we are targeting against and this super block is a vital component for
your file system health you will be able to use the backup information from the dump e2fs outputs
in conjunction with the Fisk utility so that you still can check and repair this particular system
now one other command like i say i want to talk to you about very briefly is the debug fs command
now the debug fs command this is a command line utility that allows you to do some interactive
debugging and this is going to operate with respect to ext2 ext3 and ext4 based file systems
now before we can use this interactive debugger our file system that we want to target must not
be mounted so what i will do is i will actually unmount sdb1 in case if we check we can see
sdb1 no longer is mounted let's clear the screen and i can say debug fs now what i want to do
is i want to be able to open a particular file system so i can say open and i'll say dev sdb1
and to enter and of course as per usual i want to be using pseudo privileges so i'll start this again
apologies okay so with super user privileges this time i will open now we have opened this if i want
to view file system statistics i can use the command stats within debug fs and we're going to get a
bunch of statistics if i want to browse the file system i could do ls now within this unmounted
file system there is not much to see here all we have is our lost and found directory but nevertheless
on many more file systems you may see a lot more information and we can press q to quit the program
so really what we can see here with debug fs we can get information about our unmounted file system
using things like ls we can get statistical information and quite honestly many of the
options available within debug fs are really similar to regular linux commands now a common
use case with debug fs is if you happen to maybe say delete a particular file accidentally what you
could do is you could unmount the file system and then you could use the command ls del to list your
deleted files and ultimately use the un del command with this information you receive from this output
and you can potentially although not always recover that accidentally deleted file this would be a
perfect use case of using such a tool so these tools debug fs as well as the dump e2 fs command
both of these tools give you additional features and functionality to be able to manage and recover
information based on ext based file systems so that is us for ext based file systems i hope this
has been informative for you i'd like to thank you for viewing