Linux, FreeBSD, Juniper, Cisco / Network security articles and troubleshooting guides

[b]How to read UFS filesystem super block information in FreeBSD[/b]

Use the [b]dumpfs[/b] utility (by default in FreeBSD). Quote from man:
[quote]# man dumpfs
DUMPFS(8) FreeBSD System Manager's Manual DUMPFS(8)

NAME
dumpfs -- dump UFS file system information

SYNOPSIS
dumpfs [-f] [-l] [-m] filesys | device

DESCRIPTION
The dumpfs utility prints out the UFS super block and cylinder group
information for the file system or special device specified, unless the
-f, -l or -m flag is specified. The listing is very long and detailed.
This command is useful mostly for finding out certain file system infor-
mation such as the file system block size and minimum free space percent-
age.

If -f is specified, a sorted list of all free fragments and free fragment
ranges, as represented in cylinder group block free lists, is printed.
If the flag is specified twice, contiguous free fragments are not col-
lapsed into ranges and instead printed in a simple list. Fragment num-
bers may be converted to raw byte offsets by multiplying by the fragment
size, which may be useful when recovering deleted data.

If -l is specified, the pathname to the file system's container derived
from its unique identifier is printed.

If -m is specified, a newfs(8) command is printed that can be used to
generate a new file system with equivalent settings.

SEE ALSO
disktab(5), fs(5), disklabel(8), fsck(8), newfs(8), tunefs(8)

HISTORY
The dumpfs utility appeared in 4.2BSD.

FreeBSD 9.1 Jul 14, 2011 FreeBSD 9.1[/quote]


Reading [i]/var[/i] filesystem superblock information with [b]dumpfs[/b]:
[code]# dumpfs /var | less
magic 19540119 (UFS2) time Mon Jul 22 13:50:48 2013
superblock location 65536 id [ 4fa661e4 f7c0aa2c ]
ncg 20 size 3670016 blocks 3610471
bsize 32768 shift 15 mask 0xffff8000
fsize 4096 shift 12 mask 0xfffff000
frag 8 shift 3 fsbtodb 3
minfree 8% optim time symlinklen 120
maxbsize 32768 maxbpg 4096 maxcontig 4 contigsumsize 4
nbfree 205903 ndir 44112 nifree 643408 nffree 55447
bpg 23680 fpg 189440 ipg 47360 unrefs 0
nindir 4096 inopb 128 maxfilesize 2252349704110079
sbsize 4096 cgsize 32768 csaddr 3000 cssize 4096
sblkno 24 cblkno 32 iblkno 40 dblkno 3000
cgrotor 13 fmod 0 ronly 0 clean 0
avgfpdir 64 avgfilesize 16384
flags soft-updates+journal
fsmnt /
volname swuid 0 providersize 0

cs[].cs_(nbfree,ndir,nifree,nffree):
(3644,102,44949,1494) (21376,261,44596,3772) (16132,3770,29881,3797) (18437,1371,40690,7041)
(10937,1835,30612,17343) (12519,985,37439,2427) (19055,25,46948,633) (12,1450,28024,2792)
(533,3024,30662,2020) (1043,459,32951,2339) (5271,698,16416,568) (4844,4157,24950,73)
(6822,4462,25282,1688) (17383,329,43333,2771) (19817,1245,36241,1832) (20501,2313,34224,2367)
(14562,4447,23975,701) (7377,4332,24014,397) (2475,4562,21280,847) (3163,4285,26941,545)
blocks in last group 8832


cg 0:
magic 90255 tell 20000 time Wed Jul 3 13:34:44 2013
cgx 0 ndblk 189440 niblk 47360 initiblk 47360 unrefs 0
nbfree 3644 ndir 102 nifree 44949 nffree 1494
rotor 26224 irotor 5 frotor 11792
frsum 158 144 62 54 45 48 19
sum of frsum: 1494
clusters 1-3: 37 18 11
....

[/code] Rest of the output is ommited to keep the post short.