UNIX System Administration Handbook - Evi Nemeth [90]
• Incorrect summary information in the superblock
fsck can safely and automatically fix these five problems. If fsck makes corrections to a filesystem, you should rerun it until the filesystem comes up completely clean.
Disks are normally checked at boot time with fsck -p, which examines all local file-systems listed in /etc/fstab and corrects the five errors listed above. Recent operating systems keep track of which filesystems were unmounted cleanly and check only the “dirty” ones. If some form of journaling is enabled, fsck simply tells you that the filesystem is journaled and rolls up the log to the last consistent state.
fsck -p can also be run on a particular filesystem. For example:
# fsck -p /dev/rsd0g
fsck accepts both block and character (raw) devices; it usually runs faster on the raw device. Some systems will use the raw device regardless of which one you specify.
When fsck -p reads the fstab file to find out which filesystems to check, it obeys the sequence indicated by the last field of each entry. Filesystems are checked in increasing numeric order. If two filesystems are on different disks, they can be given the same sequence number; this configuration makes fsck check them simultaneously, minimizing the time spent waiting for disk I/O. Always check the root partition first.
Errors that do not fall into one of the five categories above are potentially serious. They cause fsck -p to ask for help and then quit. In this case, run fsck without the -p option. When run in manual mode, fsck asks you to confirm each of the repairs that it wants to make. The following list shows some of the errors that fsck considers dangerous enough to warrant human intervention.
• Blocks claimed by more than one file
• Blocks claimed outside the range of the filesystem
• Link counts that are too small
• Blocks that are not accounted for
• Directories that refer to unallocated inodes
• Various format errors
Unfortunately, it is difficult to patch a disk by hand without extensive knowledge of the implementation of the filesystem. Unless you are attempting to establish yourself as a cult leader in a small town in Texas, you should never attempt to write directly to the filesystem through the device files.
Many operating systems supply a filesystem debugger (often called fsdb) that can help you examine and change low-level filesystem data, but you will still need a detailed understanding of what you are doing to use this tool effectively. As long as you stick to reading the filesystem and do not try to modify it, however, you don’t risk compounding the corruption.
In practice, this state of affairs means that you have little choice but to accept the fixes proposed by fsck. You can minimize problems by carefully recording the messages that fsck produces, since they will sometimes provide a clue about the file or files that are causing problems. If fsck asks for permission to delete a file, you should try to copy it to a different filesystem before allowing fsck to proceed. Be aware that any time you attempt to access a damaged filesystem, you risk panicking the system.
If a damaged filesystem (one that fsck cannot repair automatically) contains valuable data, do not experiment with it before making an ironclad backup. You can try to dump the disk, but since dump expects to be reading an undamaged filesystem, the resulting image may be missing data (or dump may crash). The best insurance policy is to dd the entire disk to a backup file or backup disk.
If fsck knows only the inode number of a file, you can use the ncheck command on some systems to discover the file’s pathname. To zero out a bad inode that fsck isn’t able to fix, use the clri command (the data will, of course, be lost).
If fsck finds a file whose parent directory cannot be determined, it will put the file in the lost+found directory in the top level of the filesystem. Since the name given to a file is recorded only in the file’s parent directory, names for orphan files will not be available and the files placed in lost+found