In this lesson, you will learn how forensic filesystem tools detect and repair structural inconsistencies in the disk hierarchy to ensure your data remains valid.
Why Filesystems Need Checking
Even with robust journaling mechanisms (which track pending changes), unexpected power loss or hardware faults can leave the filesystem in a state of "inconsistency." Imagine your filesystem as a giant, index-heavy library: if a power surge hits while the librarian is moving a book (a file) but before they update the main index (the inode table or block bitmap), the library becomes corrupt. The filesystem thinks a block is "in use," but no file actually points to it—or worse, two different files claim ownership of the same block.
Forensic Tools: fsck
The primary tool for these repairs is fsck (Filesystem Consistency Check). When a system boots after an unclean shutdown, the kernel often triggers this utility automatically. It performs a "forensic" audit by traversing the filesystem hierarchy and comparing the reality of the disk against the metadata stored in the superblocks and inodes.
If fsck finds an orphaned file (a file that exists but isn't linked into any directory), it will often place it in the lost+found directory located at the root of the partition.
How to Run a Check
Warning: You should never run fsck on a mounted, writable partition. Doing so while the system is actively writing data is like trying to fix a car engine while the car is driving—it will cause massive, irreversible corruption.
To check an unmounted partition (for example, /dev/sdb1), you would typically use:
# Unmount the drive first
sudo umount /dev/sdb1
# Run the consistency check
sudo fsck -y /dev/sdb1
The -y flag tells the tool to automatically answer "yes" to repair prompts, which is useful when dealing with multiple structural errors. The tool will verify the "structural integrity" of the hierarchy, ensuring that every inode is accounted for and that the block allocation maps accurately reflect the files present.
By resolving these inconsistencies, you prevent small errors from cascading into total data loss, keeping your POSIX-compliant hierarchy healthy and performant.
Key Takeaway: fsck is your forensic recovery tool for auditing and repairing the filesystem's structural map, but it must only be used on unmounted partitions to avoid further corruption.