Linux System Administration

0 of 83 lessons complete (0%)
Exit Course

Managing Unix File Systems

File System Checker

You don’t have access to this lesson

Please register or sign in to access the course content.

The File System Checker (fsck) is a system utility in Linux/Unix used to check and repair inconsistencies in the file system. It scans file systems to detect and correct issues related to file system integrity, such as corrupted files, bad blocks, or incorrect metadata, ensuring that the file system remains consistent and usable.

Basic fsck Commands:

Check and Repair a Specific Partition:
To check a specific partition and attempt repairs, use:

sudo fsck /dev/sda1

This will run fsck on the partition /dev/sda1.

Running fsck on All File Systems:
To check and repair all file systems that are listed in the /etc/fstab file, use the -A option:

sudo fsck -A

Forcing a Check:
Sometimes, fsck will skip checks on a “clean” file system. You can force a check using the -f flag:

sudo fsck -f /dev/sda1

Interactive Mode:
fsck can be run in interactive mode, asking for confirmation before making repairs:

sudo fsck -r /dev/sda1

Automatic Repairs: Use the -y option to automatically fix any issues found (use with caution):

sudo fsck -y /dev/sda1

Skip Certain Filesystems: You can skip certain file systems like network file systems with the -C or -T options to exclude certain types from checks.

Key Concepts of fsck:

When to Use fsck:

  • The system crashes or shuts down unexpectedly (e.g., due to a power failure).
  • Files or directories appear to be missing or corrupted.
  • The system won’t boot, and a file system inconsistency is suspected.
  • A specific partition is behaving unusually (slow performance, errors).

How fsck Works: The fsck tool works by checking the metadata of the file system (e.g., inodes, superblocks, data blocks) and detecting issues such as:

  • Incorrect file size in metadata.
  • Bad sectors or blocks on the disk.
  • Corrupted superblock or inode entries.
  • Lost clusters or orphaned files that are no longer attached to any directory.

File Systems Supported by fsck: fsck supports a variety of file systems, such as:

  • ext2, ext3, ext4 (common Linux file systems).
  • XFS, JFS, ReiserFS (other file systems used in Linux).
  • VFAT, NTFS (for checking Windows partitions).

For each supported file system, fsck invokes the appropriate file system-specific checker, such as:

  • e2fsck: For ext2/ext3/ext4 file systems.
  • fsck.xfs: For XFS file systems.
  • fsck.vfat: For FAT partitions.

Suppose your system crashed unexpectedly, and now your /dev/sda1 partition (which is ext4) has inconsistencies.

Step 1: Unmount the Partition

Before running fsck, it is important to unmount the partition to prevent further damage:

sudo umount /dev/sda1

If the partition is in use (e.g., it’s the root partition), you may need to boot from a Live CD/USB and run fsck from there.

Step 2: Run fsck

Once the partition is unmounted, run fsck:

sudo fsck /dev/sda1

fsck will then scan the partition and output any errors it finds, asking for confirmation on how to handle them.

Step 3: Automatically Repair Errors

To automate the process, use the -y flag:

sudo fsck -y /dev/sda1

fsck will repair all found errors without asking for confirmation.

1. Bad Superblock Repair:

If fsck reports a bad superblock, you can attempt to use one of the backup superblocks:

sudo e2fsck -b 32768 /dev/sda1

This command attempts to restore from a backup superblock located at block 32768. You can find backup superblocks using the dumpe2fs command:

sudo dumpe2fs /dev/sda1 | grep -i superblock

2. Checking Root Partition (/):

To run fsck on the root partition, you need to boot into single-user mode or use a bootable USB, as the root partition can’t be unmounted while the system is running.

3. Filesystem in Read-Only Mode:

Sometimes, Linux may remount a partition as read-only when it detects file system errors. In this case, reboot into single-user mode or use a rescue disk to run fsck on the affected partition.

  • Corrupted Inodes: Orphaned inodes that aren’t attached to any files.
  • Cross-Linked Files: Multiple files pointing to the same data block.
  • Corrupted Directory Structure: Directories that point to invalid files or paths.
  • File System Journaling Issues: In ext3/ext4 filesystems, journaling issues can prevent proper recovery.
  • Data Block Corruption: Bad sectors that can affect data integrity.

Objective:

Learn how to use fsck to check and repair file system inconsistencies.

Steps:

Simulate a File System Error:

Use the debugfs utility to create a file system corruption scenario (e.g., unlink an inode from the directory).

Example:

sudo debugfs /dev/sda1

Unmount the File System:

Unmount the partition /dev/sda1 to ensure no files are being used:

sudo umount /dev/sda1

Run fsck:

Run fsck on the unmounted partition:

sudo fsck /dev/sda1

Review the Errors:

Observe the errors reported by fsck. Allow it to fix the errors interactively or automatically by using the -y option.

Backup and Recovery:

In case of serious errors, practice recovering from a backup superblock.

Mount the Partition:

After successful repair, remount the partition:

sudo mount /dev/sda1 /mnt

Verify File Integrity:

Check the file integrity of the repaired partition by inspecting log files or opening specific directories.