Linux Filesystem Ext*

debugfs — ext2/3/4 filesystem debugger

debugfs is an interactive filesystem debugger for ext2/3/4. It can inspect (and in some cases modify) filesystem structures directly, without the filesystem being mounted.

What debugfs is good for

Inspecting inodes, directories, and ext filesystem internals
Recovering files when the filesystem is damaged (advanced)
Finding the inode number for a path
Reading file contents directly from a block device or image

Danger: debugfs can modify filesystem structures. Use read-only mode unless you know exactly what you are doing. When in doubt: mount read-only, copy data out, or use recovery tools.

Install

debugfs is typically part of the e2fsprogs package.

# Debian/Ubuntu
sudo apt install e2fsprogs

# Fedora/RHEL
sudo dnf install e2fsprogs

# Arch
sudo pacman -S e2fsprogs

10 Practical Examples

1) Open an ext filesystem (read-only recommended)

sudo debugfs -R 'stats' /dev/sdX1

Runs a single command (stats) and exits.

2) Start interactive mode (read-only)

sudo debugfs -R 'help' /dev/sdX1
sudo debugfs -c /dev/sdX1

-c opens in read-only mode (safer) on many builds.

3) Show filesystem superblock and basic info

sudo debugfs -R 'stats' /dev/sdX1

Shows UUID, block size, features, inode count, etc.

4) List a directory by inode number

sudo debugfs -R 'ls -l <2>' /dev/sdX1

In ext filesystems, inode 2 is often the root directory.

5) Find the inode number for a path

sudo debugfs -R 'stat /path/to/file' /dev/sdX1

stat prints inode, size, blocks, timestamps, and more.

6) Dump a file out of an unmounted filesystem

sudo debugfs -R 'dump /etc/fstab /tmp/fstab.recovered' /dev/sdX1

Copies a file from the filesystem to your current OS.

7) Dump by inode (useful if directory entries are damaged)

sudo debugfs -R 'dump <123456> /tmp/recovered.bin' /dev/sdX1

When you only know the inode number.

8) List deleted inodes (advanced)

sudo debugfs -R 'lsdel' /dev/sdX1

Shows recently deleted inodes that may be recoverable.

9) View a file’s block mapping

sudo debugfs -R 'blocks /path/to/file' /dev/sdX1

Maps file to disk blocks (useful in low-level forensics).

10) Use debugfs on a filesystem image

sudo debugfs -R 'stats' disk.img
sudo debugfs -R 'ls -l /' disk.img

Handy for labs, forensics, and learning without touching real disks.

Notes & Gotchas

Unmount first: for safety, use debugfs on unmounted filesystems (or a snapshot/image).
Read-only mode: prefer read-only options and the -R single-command style when possible.
Ext only: debugfs is for ext2/3/4 (not XFS, btrfs, ZFS, etc.).
Recovery limits: deleted inode recovery depends on what blocks have been overwritten.
Use e2fsck first: for corruption, e2fsck is typically step one.

Related commands: e2fsck, dumpe2fs, tune2fs, lsblk, smartctl