- ext2 - filesystem without journaling.
- ext3 - pre-allocates number of inodes at creation time.
- jfs - journaled file system from IBM
- xfs
- reiserfs - is a good choice for handling filesystems with many small files.
- FAT(12,16,32) - msdos name is used for variant of this filesystem, that supports only 8.3 filenames. vfat name designates version, that supports long names.
- NTFS
- HFS, HFS+ - Hierarchical File System from Apple
- ISO-9660 - The standard filesystem for CD-ROMs, Rock ridge extensions are available
- Joliet - filesystem for CD-ROM's was created by Microsoft for use by Windows
- UDF - The Universal Disc Format (UDF) is the next-generation filesystem for optical discs
Determine superblock location:dumpe2fs /dev/sda1|grep -i superblock
Repair filesystem, using alternative superblock:
e2fsck -f -b 8193 /dev/sda1
XFS tools:
xfs_info - provides info about xfs partition, requires that the filesystem be mounted
xfs_metadump - copies the filesystem’s metadata (filenames, file sizes, and so on) to a file.
xfs_admin - tuning xfs partition
To tune ext2/ext3 filesystems you can use tune2fs utility
debugfs is a swiss army knife for ext2/ext3 file systems,This program provides the abilities of dumpe2fs, tune2fs, and many of Linux’s normal file-manipulation tools all rolled into one. It is possible to undelete files, extract files from damaged systems, get information and much more using this programm.
Get information about filesystem:
dumpe2fs -h /dev/sda1
or
tune2fs -l /dev/sda1
Search for bad blocks:
e2fsck -c
or
mkswap -c
There are several methods of locating files in linux:
- find - search files using your patterns(size, owner, name, mtime, atime)
- locate - search only names, it returns all names, containing the specified string. It works from a database that it maintains. Most distributions include a cron job that calls locate with options that cause it to update its database periodically, such as once a night or once a week. (You can also use the updatedb command to do this task at any time.) For this reason, locate may not find recent files, or it may return the names of files that no longer exist. If the database-update utilities omit certain directories, files in them won’t be returned by a locate query.
- whereis - searches for files in a restricted set of locations, such as standard binary file directories, library directories, and man page directories.
- which - searches your path for the command that you type and lists the complete path to the first match it finds.
- type - This command isn’t really a search command; instead, it tells you how a command you type will be interpreted—as a built-in command, an external command, an alias, and so on.
Finding files based on certain permission bitsTo search files, containing certain permissions, we use find command:
find path -perm permissions
Permissions can be described in symbolic or octal form. By default find will search the exact permissions, you have defined, for example
find . -perm u=r
will search files with permissions 400. To perform more flexible search you can use / or - symbols. / means match any of permissions. - means exact match. + earlier used, but now is deprecated, / is used instead. For example:
find . -perm /og=r
will search files with o=r or g=r or both. And
find . -perm -og=r
will search only files with g=r and o=r.
Find files larger than 100 kilobytes:
find . -size +100k
Inode
As we know, in Linux everything is a file. Every file is described by inode (index node). Inode consist of:
- File type (executable, block, character, named pipe, socket, directory, link, etc)
- Permissions
- Owner
- Group
- File Size
- File access, change and modification time (UNIX or Linux never stores file creation time)
- File deletion time
- Number of links (soft/hard)
- Extended attribute such as append only or no one can delete file including root user (immutability)
- Access Control List (ACLs)
To see file's inode you can use command:
ls -i /etc/passwd 131260 /etc/passwd
To see all information you can use stat command:
stat /etc/passwd
Show inode usage of file system:
df -i /dev/sda1
Timestamps
There are 3 types of types of timestamps:
Access timestamp(atime) - it is set during any read or write operation, you can see access time, using command:
ls -lu file
Change timestamp(ctime) - it is set during changing status of the file, for example changing permissions or ownership, you can see this time using command:
ls -lc file
Modification tymestamp(mtime) - it is set during any write operation, you can see this tyme using command:
ls -l file
Touch program is used to change atime and mtime to current or specified time. If you just run touch without options, it would change atime and mtime of the file to current time. To change only atime -a option is used: touch -a file
To change only mtime -m option is used:
touch -m file
If you want to change timestamps to specified time, you need to use -t or -d options:
touch -t 200812012300.23 file
touch -d '25 Jan 2008 10:22' file
TipsDelete file using it's inode:find . -inum [inode-number] -exec rm -i {} \;
Show directory tree:
tree -d /etc | less
Change file/directory permissions separately:
Directories:
find . -type d -exec chmod XXX {} \;
Files:
find . -type f -exec chmod XXX {} \;
Create hierarchy of directories:
mkdir -p dir1/dir2/dir3
Determine type of the file:
file filename
Create FAT32 partition:
mkdosfs -F 32 /dev/***
Find files, containing “text”
grep -Hlr "text" /path
Delete old files:find /backups/tars -mtime +10 -exec rm {} \;
