Skip to content
FreeBSDDeep Dive Published Updated 3 min readViews unavailable

FreeBSD fsdb -r: Read-Only UFS Metadata Inspection

Inspect FreeBSD FFS/UFS inode, directory, and block metadata with fsdb's read-only mode while preserving a strict boundary from repair.

FreeBSD’s fsdb is an interactive FFS metadata debugger/editor. It can correlate a directory entry with an inode or show which inode owns a partition-relative block, but the manual warns it can damage an FFS filesystem beyond what fsck can repair. For inspection, use -r and keep the target unmounted.

-r is a guardrail inside fsdb, not a forensic-acquisition system. It opens the filesystem read-only and disables its write commands, but does not image the disk, stop other writers, or guarantee a stable live view. Preserve evidence or irreplaceable data in an image and examine a working copy.

Check the exact release: the FreeBSD 15.1 manual generically says exiting marks the superblock dirty and writes buffered blocks, while a 2023 source change preserves the clean flag for noncritical metadata edits and sets the unclean flag for integrity-critical changes. Treat that as a manual/source-version caveat, not a zero-write guarantee for an evidence acquisition. Use a validated write blocker and image when strict immutability matters.

Identify the filesystem before opening it

Record the FreeBSD release, device, partition layout, filesystem type, mount state, and storage errors. Do not identify a partition by capacity or familiar suffix alone. If examining the running system’s filesystem, boot from trusted external media or use a copy.

fsdb accepts a filesystem name, usually a raw disk partition. Its prompt reports the current inode; the initial selected inode is the filesystem root, inode number 2. The command loop exposes both observation commands and metadata-changing commands, so use an explicit read-only invocation:

fsdb -r /dev/<verified-ufs-partition>

Verify the device mapping before replacing the placeholder. If setup fails, do not try partitions at random; check the format and image provenance and preserve the error output.

Build a small, read-only inspection path

At the prompt, help lists commands. lookup or cd moves the active inode by path; an absolute path starts at the filesystem root. ls requires a directory; print displays the inode, and blocks also lists indirect pointers. Capture the transcript outside the source volume.

For example, a cautious sequence might look like this:

fsdb (inum 2)> ls
fsdb (inum 2)> lookup /var/log/example.log
fsdb (inum 12345)> print
fsdb (inum 12345)> blocks
fsdb (inum 12345)> quit

The inode number is illustrative. Corroborate observations: a failed path lookup can leave the last valid directory active, so check the prompt before the next command.

findblk searches for inode owners of block numbers expressed as offsets from the partition start, not absolute device sectors. Use a validated partition map and filesystem geometry; block ownership alone does not reveal file contents.

Why read-only mode is a boundary, not a repair plan

Commands such as rm, ln, chname, chmod, chown, and timestamp setters modify metadata in normal mode. With -r, documented write commands are disabled. Never omit the flag or experiment with write-oriented commands on the original; record the binary version and invocation.

Inspection does not establish consistency. fsdb is not fsck_ffs, a recovery tool, or an imager. Compare suspected corruption against a copy and release-specific checker documentation; do not repair the only source based on a plausible interactive view.

The tool flag does not make a mounted filesystem static. Unmount where possible, prevent read-write automounts, or inspect a block-level copy. For evidence, use a validated write blocker and document hashes and chain of custody.

Useful acceptance checks

Before closing, confirm the partition independently, use -r, and ensure no other process is changing the target. Preserve the transcript, image hash, device mapping, and FreeBSD version. Corroborate important inode or block relationships on another copy before making a recovery claim.

Related:

Sources:

Comments