Makale Başlıkları
Merhaba Değerli Ziyaretçimiz
Bu makalemizde sizlere Linux sistemlerde FSCK komutları ile disk yada disklerinizi nasıl kontrol ve tamir edebileceğinizi anlatacağız.Bu makalede, herhangi bir dosya sisteminin hatalarını gidermek ve düzeltmek için fsck komutunu kullanımıyla ilgili 10 pratik örnek anlatılacaktır.
1- Bir Disk Bölümü Üzerindeki Dosya Sisteminin Kontrolü
Öncelikle Parted komutunu kullanarak sisteminizdeki uygun bölümleri aşağıda gördüğünüz gibi görüntüleyelim.
# parted /dev/sda 'print' Number Start End Size Type File system Flags 1 1049kB 106MB 105MB primary fat16 diag 2 106MB 15.8GB 15.7GB primary ntfs boot 3 15.8GB 266GB 251GB primary ntfs 4 266GB 500GB 234GB extended 5 266GB 466GB 200GB logical ext4 6 467GB 486GB 18.3GB logical ext2 7 487GB 499GB 12.0GB logical fat32 lba Yada aşağıda görüldüğü gibi belirli bir dosya sistemini de kontrol edebilirsiniz.(Örn. /dev/sda6)
# fsck /dev/sda6 fsck from util-linux 2.20.1 e2fsck 1.42 (29-Nov-2011) /dev/sda6: clean, 95/2240224 files, 3793506/4476416 blocks
Aşağıdakiler Fsck komutu için mümkün olan çıkış kodlarıdır.
fsck dahili bir dosya kontrol işlemi için ilgili dosya denetleyicisi komutu kullanır. Bu fsck checker komutlar genellikle / sbin altında bulunur.
Aşağıdaki örnek, çeşitli olası fsck denetleyicisi komutları gösterir. (Örnek: fsck.ext2, fsck.ext3, fsck.ext4, vs….)
# cd /sbin # ls fsck* fsck fsck.cramfs fsck.ext2 fsck.ext3 fsck.ext4 fsck.ext4dev fsck.minix fsck.msdos fsck.nfs fsck.vfat
fsck komutu kontrol edilir dosya için bir dosya sistemi denetimi bulamaması durumunda bir hata verecektir.
Bir NTFS bölümü üzerinde fsck çalıştırmak için örneğin, aşağıdaki hata iletisini alırsınız. / Sbin altında hiçbir fsck.ntfs yoktur. Yani, bu aşağıdaki hata iletisini verir.
# fsck /dev/sda2 fsck from util-linux 2.20.1 fsck: fsck.ntfs: not found fsck: error 2 while executing fsck.ntfs for /dev/sda2
Bu seçeneği kullanarak fsck tek bir vadede bütün dosya sistemlerini kontrol edebilirsiniz. Bu / etc / fstab her dosya için belirtilen alanın değeri tarafından verilen sırayla dosya sistemini denetler.
Unutmayın 0 alanın değeri değeri ile dosya atlanır ve 0’dan büyük sırayla kontrol edilir
/ etc / fstab, aşağıda listelenen gibi girdileri içerir
# cat /etc/fstab ## proc /proc proc nodev,noexec,nosuid 0 0 ## / was on /dev/sda5 during installation /dev/sda5 / ext4 errors=remount-ro 0 1 ## /mydata was on /dev/sda6 during installation /dev/sda6 /mydata ext2 defaults 0 2 ## /backup was on /dev/sda7 during installation /dev/sda7 /backup vfat defaults 0 3
Burada, aynı alanın değeri dosya sistem içinde paralel olarak kontrol edilir.
# fsck -A
kök dosya sistemi bu global onay sırasında aşağıda gösterildiği gibi -R seçeneğini ekleyerek önerilir.
# fsck -AR -y fsck from util-linux 2.20.1 e2fsck 1.42 (29-Nov-2011) /dev/sda6: clean, 95/2240224 files, 3793506/4476416 blocks dosfsck 3.0.12, 29 Oct 2011, FAT32, LFN /dev/sda7: 8 files, 50/1463400 clusters
Not: Seçenek -y aşağıdaki örneklerden biri de açıklanmıştır.
Using fsck -t option, you can specify the list of filesystem to be checked. When you are using with option -A, the fsck will check only the filesystem mentioned with this option -t. Note that fslist is a comma separated values.
Now, pass ext2 as the fslist value to -t option as shown below:
# fsck -AR -t ext2 -y fsck from util-linux 2.20.1 e2fsck 1.42 (29-Nov-2011) /dev/sda6: clean, 11/2240224 files, 70327/4476416 blocks
In this example, /dev/sda6 is the only partition created with the filesystem ext2, thus it get checked accordingly.
Using the keyword ‘no’ in front of filesystem, you can check all other filesystem types except a particular filesystem.
In the following example, ext2 filesystem is excluded from the check.
# fsck -AR -t noext2 -y fsck from util-linux 2.20.1 dosfsck 3.0.12, 29 Oct 2011, FAT32, LFN /dev/sda7: 0 files, 1/1463400 clusters
It is a good idea to use this option as default with all your fsck operation. This prevents you from running fsck accidentally on a filesystem that is mounted.
# mount | grep "/dev/sd*" /dev/sda5 on / type ext4 (rw,errors=remount-ro) /dev/sda6 on /mydata type ext2 (rw) /dev/sda7 on /backup type vfat (rw)
As shown above, /dev/sda7 is mounted. If you try to execute fsck on this /dev/sda7 mounted filesystem (along with the -M option), fsck will simply exit with the exit code 0 as shown below.
# fsck -M /dev/sda7 # echo $? 0
Using option -T, you can skip the title get displayed in the beginning of fsck command output.
# fsck -TAR e2fsck 1.42 (29-Nov-2011) /dev/sda6 is mounted. e2fsck: Cannot continue, aborting. dosfsck 3.0.12, 29 Oct 2011, FAT32, LFN /dev/sda7: 8 files, 50/1463400 clusters
Note that the title is something like “fsck from util-linux 2.20.1″.
By default fsck tries to skip the clean file system to do a quicker job.
# fsck /dev/sda6 fsck from util-linux 2.20.1 e2fsck 1.42 (29-Nov-2011) /dev/sda6: clean, 95/2240224 files, 3793503/4476416 blocks
You can force it to check the file system using -f as shown below.
# fsck /dev/sda6 -f fsck from util-linux 2.20.1 e2fsck 1.42 (29-Nov-2011) Pass 1: Checking inodes, blocks, and sizes Pass 2: Checking directory structure Pass 3: Checking directory connectivity Pass 4: Checking reference counts Pass 5: Checking group summary information /dev/sda6: 95/2240224 files (7.4% non-contiguous), 3793503/4476416 blocks
In the following example, /dev/sda6 partition is corrupted as shown below.
# mount /dev/sda6 /mydata # cd /mydata # ls -li ls: cannot access test: Input/output error total 72 49061 -rw-r--r-- 1 root root 8 Aug 21 21:50 1 49058 -rw-r--r-- 1 root root 36864 Aug 21 21:24 file_with_holes 49057 -rw-r--r-- 1 root root 8192 Aug 21 21:23 fwh 11 drwxr-xr-x 2 root root 49152 Aug 19 00:29 lost+found 2060353 ?rwSr-S-wT 16 root root 4096 Aug 21 21:11 Movies ? -????????? ? ? ? ? ? test
As seen above, the directory Movies and a file test attributes are invalid.
In the following example, -y will pass “yes” to all the questions to fix the detected corruption automatically.
# fsck -y /dev/sda6 fsck from util-linux 2.20.1 e2fsck 1.42 (29-Nov-2011) /dev/sda6 contains a file system with errors, check forced. Pass 1: Checking inodes, blocks, and sizes Inode 2060353 is a unknown file type with mode 0137642 but it looks like it is really a directory. Fix? yes Pass 2: Checking directory structure Entry 'test' in / (2) has deleted/unused inode 49059. Clear? yes Pass 3: Checking directory connectivity Pass 4: Checking reference counts Pass 5: Checking group summary information /dev/sda6: ***** FILE SYSTEM WAS MODIFIED ***** /dev/sda6: 96/2240224 files (7.3% non-contiguous), 3793508/4476416 blocks
It is possible to print such detected problems into stdout without repairing the filesystem using fsck -n option.
First, you could notice/see the problem in partition /dev/sda6 that the Movies directory (and fwh file) doesn’t have valid attribute details.
# mount /dev/sda6 /mydata # cd /mydata # ls -lrt total 64 drwxr-xr-x 2 root root 49152 Aug 19 00:29 lost+found ?--xrwx-wx 16 root root 4096 Aug 21 21:11 Movies ?-----x-wx 1 root root 8192 Aug 21 21:23 fwh -rw-r--r-- 1 root root 36864 Aug 21 21:24 file_with_holes -rw-r--r-- 1 root root 8 Aug 21 21:50 1
The above problem in the specific partition displayed in stdout without doing any fix on it as follows,
The following fsck example displays the problem in the stdout without fixing it. (partial output is shown below).
# fsck -n /dev/sda6 fsck from util-linux 2.20.1 e2fsck 1.42 (29-Nov-2011) /dev/sda6 contains a file system with errors, check forced. Pass 1: Checking inodes, blocks, and sizes Inode 2060353 is a unknown file type with mode 0173 but it looks like it is really a directory. Fix? no Inode 2060353, i_blocks is 8, should be 0. Fix? no Pass 2: Checking directory structure Inode 2060353 (/Movies) has invalid mode (0173). Clear? no Inode 49057 (/fwh) has invalid mode (013). Clear? no Entry 'fwh' in / (2) has an incorrect filetype (was 1, should be 0). Fix? no Pass 3: Checking directory connectivity Unconnected directory inode 65409 (???) Connect to /lost+found? no '..' in ... (65409) is ??? (2060353), should be (0). Fix? no Unconnected directory inode 2076736 (???) Connect to /lost+found? no Pass 4: Checking reference counts Inode 2 ref count is 4, should be 3. Fix? no Inode 65409 ref count is 3, should be 2. Fix? no Inode 2060353 ref count is 16, should be 15. Fix? no Unattached inode 2060354 Connect to /lost+found? no Pass 5: Checking group summary information Block bitmap differences: -(164356--164357) -4149248 Fix? no Directories count wrong for group #126 (1, counted=0). Fix? no /dev/sda6: ********** WARNING: Filesystem still has errors ********** /dev/sda6: 96/2240224 files (7.3% non-contiguous), 3793508/4476416 blocks
In order to repair the damaged portion automatically ( without any user interaction ), use the option -a as shown below.
# fsck -a -AR
The option -a is same as -p in e2fsck utility. It cause e2fsck to fix any detected problems that has to be safely fixed without user interaction.
In case when fsck requires administrator’s attention, it simply exits with error code 4 before printing the description of the problem.
# fsck -a /dev/sda6 fsck from util-linux 2.20.1 /dev/sda6 contains a file system with errors, check forced. /dev/sda6: Inode 2060353 is a unknown file type with mode 0173 but it looks like it is really a directory. /dev/sda6: UNEXPECTED INCONSISTENCY; RUN fsck MANUALLY. (i.e., without -a or -p options) # echo $? 4
As you remember, fsck -y option can be used here to fix the above issue automatically.
# fsck -y /dev/sda6 fsck from util-linux 2.20.1 e2fsck 1.42 (29-Nov-2011) /dev/sda6 contains a file system with errors, check forced. Pass 1: Checking inodes, blocks, and sizes Inode 2060353 is a unknown file type with mode 0173 but it looks like it is really a directory. Fix? yes Pass 2: Checking directory structure Inode 49057 (/fwh) has invalid mode (013). Clear? yes Pass 3: Checking directory connectivity Pass 4: Checking reference counts Pass 5: Checking group summary information Block bitmap differences: -(164356--164357) Fix? yes Free blocks count wrong for group #5 (0, counted=2). Fix? yes Free blocks count wrong (682908, counted=682910). Fix? yes /dev/sda6: ***** FILE SYSTEM WAS MODIFIED ***** /dev/sda6: 95/2240224 files (7.4% non-contiguous), 3793506/4476416 blocks Yardımcı olması dileğiyle...
“a.tr Geçiş Süreci” kapsamında işlemlerin yürütüleceği 3. Kategori Başvuruları 14 Şubat 2024’te başladı. Bu kategori sırasıyla;… Read More
Sayın Müşterimiz,Ekonomikhost İnternet ve Bilişim Hizmetleri olarak, öğretmenlerimize ve 20. yıldönümümüze özel bir kampanya ile… Read More
Siz değerli müşterilerimize her zaman daha iyi hizmet sunmanın yollarını arıyoruz vebu sefer sizin için… Read More
Sayın Ekonomikhost Müşterileri, Bugün Ekonomikhost olarak büyük bir gurur ve mutlulukla 20. yılımızı kutlamanın heyecanını… Read More
Caching (önbelleğe alma), bilgisayar sistemlerinde ve yazılımlarda sık kullanılan verilerin geçici olarak saklanmasıdır. Bu, veriye… Read More
Bu makalemizde Windows Forensic incelemelerinde göz atılabilecek delillerden birisi olan Shellbag’lerden bahsedeceğiz. Windows’ta bir pencereyi… Read More