Filesystems, files

• ext2 - filesystem without journaling.


• ext3 - pre-allocates number of inodes at creation time.


• jfs - journaled file system from IBM


• xfs


• reiserfs - is a good choice for handling filesystems with many small files.


• FAT(12,16,32) - msdos name is used for variant of this filesystem, that supports only 8.3 filenames. vfat name designates version, that supports long names.


• NTFS


• HFS, HFS+ - Hierarchical File System from Apple


• ISO-9660 - The standard filesystem for CD-ROMs, Rock ridge extensions are available


• Joliet - filesystem for CD-ROM's was created by Microsoft for use by Windows


• UDF - The Universal Disc Format (UDF) is the next-generation filesystem for optical discs

Determine superblock location:

dumpe2fs /dev/sda1|grep -i superblock

Repair filesystem, using alternative superblock:

e2fsck -f -b 8193 /dev/sda1

XFS tools:
xfs_info - provides info about xfs partition, requires that the filesystem be mounted
xfs_metadump - copies the filesystem’s metadata (filenames, file sizes, and so on) to a file.
xfs_admin - tuning xfs partition

To tune ext2/ext3 filesystems you can use tune2fs utility

debugfs is a swiss army knife for ext2/ext3 file systems,This program provides the abilities of dumpe2fs, tune2fs, and many of Linux’s normal file-manipulation tools all rolled into one. It is possible to undelete files, extract files from damaged systems, get information and much more using this programm.

Get information about filesystem:

dumpe2fs -h /dev/sda1
or

tune2fs -l /dev/sda1

Search for bad blocks:

e2fsck -c
or

mkswap -c

There are several methods of locating files in linux:

• find - search files using your patterns(size, owner, name, mtime, atime)


• locate - search only names, it returns all names, containing the specified string. It works from a database that it maintains. Most distributions include a cron job that calls locate with options that cause it to update its database periodically, such as once a night or once a week. (You can also use the updatedb command to do this task at any time.) For this reason, locate may not find recent files, or it may return the names of files that no longer exist. If the database-update utilities omit certain directories, files in them won’t be returned by a locate query.


• whereis - searches for files in a restricted set of locations, such as standard binary file directories, library directories, and man page directories.


• which - searches your path for the command that you type and lists the complete path to the first match it finds.


• type - This command isn’t really a search command; instead, it tells you how a command you type will be interpreted—as a built-in command, an external command, an alias, and so on.

Finding files based on certain permission bits
To search files, containing certain permissions, we use find command:

find path -perm permissions
Permissions can be described in symbolic or octal form. By default find will search the exact permissions, you have defined, for example

find . -perm u=r
will search files with permissions 400. To perform more flexible search you can use / or - symbols. / means match any of permissions. - means exact match. + earlier used, but now is deprecated, / is used instead. For example:

find . -perm /og=r
will search files with o=r or g=r or both. And

find . -perm -og=r
will search only files with g=r and o=r.
Find files larger than 100 kilobytes:

find . -size +100k

Inode

As we know, in Linux everything is a file. Every file is described by inode (index node). Inode consist of:

• File type (executable, block, character, named pipe, socket, directory, link, etc)


• Permissions


• Owner


• Group


• File Size


• File access, change and modification time (UNIX or Linux never stores file creation time)


• File deletion time


• Number of links (soft/hard)


• Extended attribute such as append only or no one can delete file including root user (immutability)


• Access Control List (ACLs)

To see file's inode you can use command:

ls -i /etc/passwd 131260 /etc/passwd

To see all information you can use stat command:

stat /etc/passwd

Show inode usage of file system: 

df -i /dev/sda1

Timestamps
There are 3 types of types of timestamps:
Access timestamp(atime) - it is set during any read or write operation, you can see access time, using command:

ls -lu file
Change timestamp(ctime) - it is set during changing status of the file, for example changing permissions or ownership, you can see this time using command:

ls -lc file
Modification tymestamp(mtime) - it is set during any write operation, you can see this tyme using command:

ls -l file

Touch program is used to change atime and mtime to current or specified time. If you just run touch without options, it would change atime and mtime of the file to current time. To change only atime -a option is used: touch -a file

To change only mtime -m option is used:

touch -m file

If you want to change timestamps to specified time, you need to use -t or -d options:

touch -t 200812012300.23 file 

touch -d '25 Jan 2008 10:22' file

Tips

Delete file using it's inode:

find . -inum [inode-number] -exec rm -i {} \;

Show directory tree:

tree -d /etc | less

Change file/directory permissions separately:

Directories: 

find . -type d -exec chmod XXX {} \; 

Files: 

find . -type f -exec chmod XXX {} \;

Create hierarchy of directories:

mkdir -p dir1/dir2/dir3

Determine type of the file:

file filename

Create FAT32 partition:
mkdosfs -F 32 /dev/***

Find files, containing “text”
grep -Hlr "text" /path 

Delete old files:

find /backups/tars -mtime +10 -exec rm {} \;