Linux, FreeBSD, Juniper, Cisco / Network security articles and troubleshooting guides

It is currently Fri Jul 03, 2020 5:37 pm

Message body:
Enter your message here, it may contain no more than 60000 characters. 

:D :) ;) :( :o :shock: :? 8-) :lol: :x :P :oops: :cry: :evil: :twisted: :roll: :!: :?: :idea: :arrow: :| :mrgreen: :geek: :ugeek:
Font size:
Font colour
BBCode is ON
[img] is ON
[flash] is OFF
[url] is ON
Smilies are ON
Disable BBCode
Disable smilies
Do not automatically parse URLs
Confirmation code
Confirmation code:
In an effort to prevent automatic submissions, we require that you enter both of the words displayed into the text field underneath.

Topic review - How to print filesystem super block information in Linux
Author Message
Post subject: How to print filesystem super block information in Linux  |  Post Posted: Mon Jul 08, 2013 6:56 am
A linux filesystem is made of multiple blocks out of which some of them have a special status. These are called "superblocks".

These special blocks contain meta data information about the filesystem such as filesystem UUID (Universally Unique ID - used, among other things, by grub to mount filesystems), filesystem features (like dir_index, ext_attr), default mount options, OS type, file system block size and many others.

To read information from filesystem superblock, use the "dumpe2fs" command with the '-h' argument, for header. "man dumpe2fs" quote:"

dumpe2fs - dump ext2/ext3 filesystem information

dumpe2fs [ -bfhixV ] [ -ob superblock ] [ -oB blocksize ] device

dumpe2fs prints the super block and blocks group information for the filesystem present on device.

dumpe2fs is similar to Berkeley’s dumpfs program for the BSD Fast File System.

-b print the blocks which are reserved as bad in the filesystem.

-ob superblock
use the block superblock when examining the filesystem. This option is not usually needed except by a filesystem wizard who is examining the
remains of a very badly corrupted filesystem.

-oB blocksize
use blocks of blocksize bytes when examining the filesystem. This option is not usually needed except by a filesystem wizard who is examining
the remains of a very badly corrupted filesystem.

-f force dumpe2fs to display a filesystem even though it may have some filesystem feature flags which dumpe2fs may not understand (and which can
cause some of dumpe2fs’s display to be suspect).

-h only display the superblock information and not any of the block group descriptor detail information.

-i display the filesystem data from an image file created by e2image, using device as the pathname to the image file.

-x print the detailed group information block numbers in hexadecimal format

-V print the version number of dumpe2fs and exit.

You need to know the physical filesystem structure to understand the output.

dumpe2fs was written by Remy Card <>. It is currently being maintained by Theodore Ts’o <>.

dumpe2fs is part of the e2fsprogs package and is available from

e2fsck(8), mke2fs(8), tune2fs(8)

E2fsprogs version 1.39 May 2006 DUMPE2FS(8)

# dumpe2fs -h /dev/sda1
dumpe2fs 1.39 (29-May-2006)
Filesystem volume name:   /boot
Last mounted on:          <not available>
Filesystem UUID:          e8ccc97b-2012-4b41-9c2a-17f328d65d83
Filesystem magic number:  0xEF53
Filesystem revision #:    1 (dynamic)
Filesystem features:      has_journal ext_attr resize_inode dir_index filetype needs_recovery sparse_super
Default mount options:    user_xattr acl
Filesystem state:         clean
Errors behavior:          Continue
Filesystem OS type:       Linux
Inode count:              26104
Block count:              104388
Reserved block count:     5219
Free blocks:              88808
Free inodes:              26069
First block:              1
Block size:               1024
Fragment size:            1024
Reserved GDT blocks:      256
Blocks per group:         8192
Fragments per group:      8192
Inodes per group:         2008
Inode blocks per group:   251
Filesystem created:       Wed Sep 22 19:22:20 2010
Last mount time:          Fri Apr 12 10:49:03 2013
Last write time:          Fri Apr 12 10:49:03 2013
Mount count:              22
Maximum mount count:      -1
Last checked:             Wed Sep 22 19:22:20 2010
Check interval:           0 (<none>)
Reserved blocks uid:      0 (user root)
Reserved blocks gid:      0 (group root)
First inode:              11
Inode size:               128
Journal inode:            8
Default directory hash:   tea
Directory Hash Seed:      a0d43bca-cfe0-44a9-bc06-484f9a2d18ba
Journal backup:           inode blocks
Journal size:             4114k

The above output shows the filesystem UUID, the fact that I have "dir_index" filesystem index ( more on this later ), it uses filesystem access lists, it has 104388 blocks, block size 1024, filesystem creation timestamp, last mount timestamp, the journal inode and many more details.

What you should know is that Linux keeps a copy of the supernode in more than one location, at specific block offsets, by default. To find all backups of the supernode, use below command:
# dumpe2fs /dev/sda1 | grep -i superbl
dumpe2fs 1.39 (29-May-2006)
  Primary superblock at 1, Group descriptors at 2-2
  Backup superblock at 8193, Group descriptors at 8194-8194
  Backup superblock at 24577, Group descriptors at 24578-24578
  Backup superblock at 40961, Group descriptors at 40962-40962
  Backup superblock at 57345, Group descriptors at 57346-57346
  Backup superblock at 73729, Group descriptors at 73730-73730

In a nutshell, obviously, backup superblocks are redundant and they are used to recover a filesystem when the primary superblock is corrupt or has stale information.
Jump to:  
cronNews News Site map Site map SitemapIndex SitemapIndex RSS Feed RSS Feed Channel list Channel list

Delete all board cookies | The team | All times are UTC - 5 hours [ DST ]