Home

Corrupt a Filesystem

1 Overview

When an inode becomes invalid, the filesystem is considered as corrupted.

Reproduce cases:

Create an orphaned file.
Create an invalid file mode.
Create two files sharing the same block.

2 Setup Lab

2.1 Initial Setup

Setup lab: Alpine 1 Node.
Install packages to the VM.

vm$ apk add lsblk e2fsprogs-extra util-linux file

2.2 Create a Filesystem

Create a disk image.

container$ QEMU-img create -f qcow2 disk.qcow2 2G

Add the disk image to the VM.

# Switch from VM console to QEMU monitor:   Ctrl + A C

# Plug disk to VM
(qemu) drive_add 0 file=disk.qcow2,media=disk,if=none,id=mydrive
(qemu) device_add virtio-blk-pci,drive=mydrive,id=mydevice

# Switch from QEMU monitor to VM console:   Ctrl + A C

# Check if disk added
vm$ lsblk
NAME   MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
vda    253:0    0    2G  0 disk

Create a partition.

vm$ fdisk /dev/vda
(fdisk) o   # create a new empty DOS partition table
(fdisk) w   # write changes

vm$ fdisk /dev/vda
(fdisk) n   # add a new partition
            # partition type: primary partition
            # partition number: (default)
            # first sector: (default)
            # last sector: +1G
(fdisk) w   # write changes

vm$ lsblk
NAME   MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
vda    253:0    0    2G  0 disk
└─vda1 253:1    0    1G  0 part

Make a filesystem.

vm$ mkfs.ext4 /dev/vda1
vm$ fsck -fn /dev/vda1

Mount the filesystem.

vm$ mkdir /mnt/vda1
vm$ mount /dev/vda1 /mnt/vda1

3 Create an Orphaned File

The inode link count is the number of filenames or hard links that point to the inode. An inode with a zero link count is known as an orphaned file. The fsck considers an orphaned file as a incomplete deletion error.

Create a test file.

vm$ echo 'Hello A' > /mnt/vda1/file_a

Unmount the filesystem.

vm$ umount /mnt/vda1

Show inode links count of the file.

vm$ debugfs -w /dev/vda1
(debugfs) ls -l
#   inode   filetype & mode       link_count      uid    gid      size    last modification   name
#           (octal)
     11     100644              (1)             0      0        8       13-Sep-2026 10:04   file_a

# filetype & mode: 100644
#     10 (file type), 0 (special permission), 644 (owner,group,other permissions)

(debugfs) show_inode_info file_a
Links: 1

Set inode link count to zero.

(debugfs) set_inode_field file_a links_count 0
(debugfs) show_inode_info file_a
Links: 0

Check fsck.

vm$ fsck -fn /dev/vda1
/dev/vda1: WARNING: Filesystem still has errors

4 Create an Invalid-Mode File

TODO…