Fsck-Linux File System Check Tool Introduction

1. Brief Introduction

Every time windows is used to exit the system abnormally, Scandisk will be swept away. Linux is no exception, but it calls fsck.ProgramTo check the file system. As a system administrator, what do you do when you find that the file system is faulty? Of course, manually run fsck to check the file system. Therefore, this article teaches you how to correctly use and use the fsck tool.

2. File System

2.1. superblock)

A file system is always defined by its superblock. Therefore, when a file system is created, the superblock is also created. It contains some basic parameters of the file system, such as the number of data blocks and the maximum number of files in the file system. This is because superblock contains some critical data for catastrophic recovery. The default superblock is always at the beginning of the disk partition where the file system is located. Superblock also has a backup called redundant superblock, just like a copy of the file allocation table in DOS. The redundant superblock is not the same as the default superblock. It is stored in the disk partition discretely.

A specific file is regarded as a directory or contains a pointer to its content. Each file has a descriptor associated with the file node (inode. A file node contains file attributes, such as the file owner, last modification time, last access time, And pointer to the file data block. Assuming that the first 12 data blocks of a file are directly pointed to by variables in the file node structure, the file node structure may also contain pointers to indirect file data blocks to expand the file content in the future. In fact, the file node structure contains three levels of data block pointers. If a file contains 4096 bytes of data, the first level of indirect data block contains 1024 bytes, the second-level indirect data block contains 1024 bytes and is directed by the second-level indirect data block. Likewise, level 2 indirect data blocks also point to level 3 indirect data blocks with a size of 1024 bytes. In fact, Level 3 indirect data blocks are rarely used in practical applications, because they are generally not that large files. The data block size of the file system is stored in the superblock, which makes it possible to access the file system of different data blocks in the same system at the same time.

Finally, the size of the file data block is specified when the file system is created and cannot be changed in future use.

2.2. Summary information)

Summary information is associated with superblock and is uniquely associated. When the file system is changed, it records this change, records the number of data blocks, fragments, file nodes, directories, and other information in the file system.

2.3. cylinder groups)

The file system divides a disk into one or more "cylindrical groups", which contain one or more consecutive disk cylinders. Each cylindrical group indicates the node slot of the file. A block map describes all available data blocks in the cylindrical group, the summary information describes the usage of data blocks in the cylindrical group. When a file system is generated, the number of file nodes in the cylindrical group is determined. Currently, the general rule is that a file node is allocated every 2048 bytes on the disk. Group information is recorded at the beginning of each cylindrical group. If a disk error occurs, the group information is lost.
2.4. Fragments)

To prevent disk space waste when storing small files, the file system allows a data block to be divided into 2, 4, or 8 parts. The minimum disk share is the size of the cluster, usually 512 bytes. Each data block image associated with a cylindrical group records the degree of disk space fragmentation.

2.5. file system updates

In daily work, we create and delete hundreds of files. The operating system generates a series of file system updates. When data is written to a disk, a continuous file system is generated, and the file system updates all critical information. When you change the file system, for example, when you execute write, the data to be written is copied into the buffer zone called In-core of the system kernel. Therefore, this data update is not synchronized, data is actually written to the disk only when the write function is executed and returned. You can also manually execute the sync command to force data to be written to the disk. In addition, whenever the kernel's In-core buffer is used for new purposes, the system will also use/etc/update to call sync to write data to the disk.

3. repair damaged file systems

There are many ways to damage the file system, the most common is abnormal shutdown and some hardware errors. The reason is that no sync is executed before the system is shut down and the CPU is suspended to write data to the disk. As a result, the file system is incomplete. In addition, hardware errors are fatal, especially the physical damage to the disk, which will lead to permanent data loss.

3.1. Detect and repair damaged file systems

In normal times, fsck does not perform interactive execution, but is automatically executed when it is started up when it does not exit the system normally. This function is a subset of the fsck for interactive execution. Therefore, the introduction below is based on interactive execution, and all possible errors will be captured. In this mode, we can take corresponding repair measures based on the error type. For a static file system, fsck checks its structural integrity. In the following introduction, we will focus on discovering errors in the cylindrical group, file nodes, indirect file nodes, and data blocks and various possible repair measures.
3.2. Super data block check

A common form of file system corruption is the destruction of super data blocks in summary information. The summary information is easily damaged, because any changes to the file system will lead to modification of the summary information, and it is easy to be damaged during abnormal exit. The super data block check mainly targets the file system length, number of file nodes, idle data block statistics, and idle file node statistics; the length of the file system must be greater than the total number of data blocks used by the super data block and the total number of data blocks used by the file node list. For fsck, the length of the file system and its layout information are the most important.

3.3. Check idle data blocks

Fsck checks all data blocks marked as unused in the data block image of the cylindrical group, that is, idle data blocks. Fsck calculates the number of idle data blocks and adds them to the number of data blocks used by file nodes. Check whether the result is equal to the sum of all data blocks in the file system. If fsck finds that the data block allocation image is incorrect, it will automatically recreate it. The information associated with the super data block in the summary information contains the number of all idle data blocks in the file system. Fsck compares the number of idle data blocks it obtains with the number of idle data blocks in the preceding summary. If the two are inconsistent, fsck overwrites the idle data block information in the summary. The check of idle file nodes is also processed.

3.4. Check the file node status

A single file node generally does not have errors. However, because a large number of file nodes are active in the file system, a small number of file nodes may have errors. Fsck checks from the second file node (File node 0 is marked as "not used", file Node 1 is reserved for use) until the last file node. Each file node is checked for the format, type, number of links, duplicate data blocks, bad data blocks, and node size.

Each file node has a schema definition that indicates the type and allocation status of the file node. These types include: common nodes, directory nodes, symbolic connection nodes, special block device nodes, special character device nodes, and socket nodes are allocated in three states: unallocated, allocated, and unallocated, A node in the non-allocation status indicates that the node has an incorrect node format. This is often caused by illegal data writing. In this case, fsck clears the content of this file node.

3.5. File node Link

Each file node contains the total number of links to directory items. To check the number of links of a file node, fsck starts scanning from the root directory and progressively decreases the number of links in the directory items, finally, compare the number of links obtained with the number of links included in the file node. If they are inconsistent, fsck will save the actual number of links to the file node. If the number of links is found to be zero, this directory item is discarded, and fsck stores this directory item in the lost + found directory item. Each file node stores a list or pointer to the list, which contains the data blocks used by the node. Because the indirect data block is owned by the file node, if it is damaged, it will directly affect the file node. Fsck checks whether the data block owned by a file node exists in the "allocated data block" list. If not, it checks whether it exists in "Duplicate blocks) "If none of them exist in the list, add the block number of the data block to the" allocated data block "list. In addition, because there is not enough information to indicate the correctness of the data block content pointed to by the file node, it cannot be detected if the file content is changed. If the data block content changes due to a hardware fault, fsck clears the data block and file node at the same time. Fsck checks the data blocks corresponding to all data block numbers contained in a file node, if the data block number is smaller than or greater than the smallest data block number in the file system, it is set to a bad block. Bad blocks are usually caused by hardware faults. If a file node contains a bad block number, fsck clears the node.

3.6. File node data size

Each file node has the total number of data blocks it contains. This is always the sum of the number of allocated data blocks and the number of indirect data blocks. Fsck compares the total number of data blocks it calculates with the total number of data blocks in the file node to see if the two are consistent. If they are different, fsck will fix them. In addition, each file node contains a 32-bit length field, which indicates the description of the file size in bytes.

3.7. Check the data associated with the file Node

A file node can be associated with three types of data blocks. They are plain data blocks, symbolic link data blocks, and directory data blocks ).

The unformatted data block contains the file content, the symbolic link data block contains the path to the file, and the directory data block contains the structure information of the directory.
Fsck can only check the validity of directory data blocks. It checks a series of directory errors, these include the unallocated file node pointed to by the directory node number, whether the directory node number is greater than the maximum directory node number allowed in the file system, about the directory item ". "and ".. "node number is wrong, and a directory data block is attached to the file system, and so on. If a directory node is of the "unallocated node" type, fsck will delete the entire directory node and the directory data block it contains, which is usually caused by hardware failure. When an invalid data is written to a directory data block, the directory node will run out of the file system node list. In this case, fsck will delete the directory node. In addition, for the Directory item ". "When the data block number is required, the first item in the data block list of the directory node is equivalent to this directory node. If not, fsck will correct it and make it the first data block in the data block list of the node in this directory.

3.8. File System connectivity

Fsck checks the connectivity of the file system and checks whether all directory items are linked to the file system. If not, it stores them in the lost + found Directory, which usually occurs in hardware faults.