fsdb(ADM) 19 June 1992 fsdb(ADM) Name fsdb - filesystem debugger Syntax /etc/fsdb special [ - ] Description fsdb can be used to patch up a damaged filesystem after a crash. It has conversions to translate block and inumbers into their corresponding disk addresses. Also included are mnemonic offsets to access different parts of an inode. These greatly simplify the process of correcting control block entries or descending the filesystem tree. fsdb should only be used on an unmounted filesystem. fsdb contains several error-checking routines to verify inode and block addresses. These can be disabled if necessary by invoking fsdb with the optional - argument or by the use of the ``O'' symbol. ( fsdb reads the i-size and f-size entries from the superblock of the filesystem as the basis for these checks.) Numbers are considered decimal by default. Octal numbers must be pre- fixed with a zero. During any assignment operation, numbers are checked for a possible truncation error due to a size mismatch between source and destination. fsdb reads a block at a time and will therefore work with raw as well as block I/O. A buffer management routine is used to retain commonly used blocks of data in order to reduce the number of read system calls. All assignment operations result in an immediate write-through of the corre- sponding block. The symbols recognized by fsdb are: # absolute address i convert from inumber to inode address b convert to block address d directory slot offset +, - address arithmetic q quit >, < save, restore an address = numerical assignment =+ incremental assignment =- decremental assignment = character string assignment O error checking flip flop p general print facilities , general print facilities f file print facility B byte mode W word mode D double word mode ! escape to shell The print facilities generate a formatted output in various styles. The current address is normalized to an appropriate boundary before printing begins. It advances with the printing and is left at the address of the last item printed. The output can be terminated at any time by typing the delete character. If a number follows the ``p'' symbol, that many entries are printed. A check is made to detect block boundary overflows since logically sequential blocks are generally not physically sequen- tial. If a count of zero is used, all entries to the end of the current block are printed. The print options available are: i print as inodes d print as directories o print as octal short words e print as decimal short words x print as hexadecimal short words c print as characters b print as octal bytes The f symbol is used to print data blocks associated with the current inode. If followed by a number, that block of the file is printed. (Blocks are numbered from zero.) The desired print option letter follows the block number, if present, or the f symbol. This print facility works for small as well as large files. It checks for special devices and that the block pointers used to find the data are not zero. Dots, tabs, and spaces may be used as function delimiters but are not necessary. A line with just a new-line character will increment the current address by the size of the data type last printed. That is, the address is set to the next byte, word, double word, directory entry or inode, allowing the user to step through a region of a filesystem. In- formation is printed in a format appropriate to the data type. Bytes, words and double words are displayed with the octal address followed by the value in octal and decimal. A .B or .D is appended to the address for byte and double word values, respectively. Directories are printed as a directory slot offset followed by the decimal inumber and the char- acter representation of the entry name. I-nodes are printed with labeled fields describing each element. The following mnemonics are used for inode examination and refer to the current working inode: md mode ln link count uid user ID number gid group ID number sz file size a# data block numbers (0 - 12) at access time mt modification time maj major device number min minor device number Examples 386i prints inumber 386 in an inode format. This now becomes the current working inode. ln=4 changes the link count for the working inode to 4. ln=+1 increments the link count by 1. fc prints, in ASCII, block zero of the file associated with the working inode. 2i.fd prints the first 32 directory entries for the root inode of this filesystem. d5i.fc changes the current inode to that associated with the 6th directory entry (numbered from zero) found from the above command. The first logical block of the file is then printed in ASCII. 512B.p0x prints the superblock of this filesystem in hexadecimal. 2i.a0b.p3d prints the first 3 entries in the root directory. This example also shows how several operations can be combined on one command line. 2i.a0b.d7=3 changes the inumber for the seventh directory slot in the root directory to 3. d7.nm="name" changes the name field in the directory slot to the given string. Quotes are optional when used with nm if the first character is alphabetic. a2b.p0d prints the third block of the current inode as directory entries. Notes The directory /etc/fscmd.d/TYPE contains programs for each filesystem type; each of these programs applies some appropriate heuristic to deter- mine whether the supplied special file is of the type for which it checks. See also dir(FP), filesystem(FP), fsck(ADM), ``Troubleshooting your system'' in the System Administrator's Guide.