Linux filesystem repair: e2fsck, xfs_repair, btrfs check

Filesystem repair tools restore metadata consistency after corruption. They are a last resort, repair prioritizes filesystem structure over data preservation, and a recent backup restore is always safer when available.

When to repair vs restore from backup

Corruption symptoms

# Check kernel logs for filesystem errors
dmesg | grep -E "(EXT4|XFS|BTRFS|I/O|corruption)"
journalctl -b | grep -E "(EXT4|XFS|BTRFS|I/O|corruption)"

Common indicators: files go missing or contain wrong data, Input/output error on access, Structure needs cleaning on mount, elevated iowait.

Unmounting safely before repair

# Find processes using the mount
lsof /mnt/point
fuser -m /mnt/point

# Stop processes, then unmount
umount /mnt/point

# Lazy unmount if processes can't be stopped
umount -l /mnt/point

# Force unmount (NFS/FUSE only)
umount -f /mnt/point

# For root filesystem: boot from live USB or single-user mode
# Or schedule fsck at next boot:
touch /forcefsck
# Or force check via mount count:
tune2fs -C 1 /dev/sdX1

Ext2/3/4 repair, e2fsck

Always check first (read-only)

# Read-only check, no changes
e2fsck -n /dev/sdX1

Automatic repair (preen)

# Safe automatic repairs only
e2fsck -p /dev/sdX1

# Yes to all (more aggressive)
e2fsck -y /dev/sdX1

# Force check even if clean flag is set
e2fsck -f /dev/sdX1

Bad block scanning

# Read-only bad block scan
e2fsck -c /dev/sdX1

# Non-destructive read-write scan (more thorough)
e2fsck -cc /dev/sdX1

Bad blocks are added to the bad block inode and won't be allocated to files. On SSDs, prefer SMART monitoring, the firmware remaps bad blocks transparently.

Directory optimization

# Reindex and sort directories
e2fsck -D /dev/sdX1

The lost+found directory

fsck places orphaned inodes (files whose directory entries were corrupted) in /lost+found/, named by inode number. After repair, examine and rehome them:

ls -la /mnt/lost+found
# Identify files by content, UID/GID, or timestamps
# Recreate lost+found if deleted:
mklost+found /mnt

Ext4 superblock recovery

Ext4 stores backup superblocks in specific block groups. If the primary superblock is damaged, repair from a backup.

Find backup superblock locations

# Method 1: dumpe2fs (if primary is readable)
dumpe2fs /dev/sdX1 | grep -i superblock

# Method 2: mke2fs -n (dry run, shows where backups would be)
mke2fs -n /dev/sdX1

Typical backup locations for 4K block filesystems with sparse_super:

32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
4096000, 7962624, 11239424, 20480000, 23887872

Repair from a backup superblock

# Try each backup until one works
e2fsck -b 32768 -y /dev/sdX1
e2fsck -b 98304 -y /dev/sdX1
e2fsck -b 163840 -y /dev/sdX1

On success, e2fsck updates the primary superblock automatically.

XFS repair, xfs_repair

Always dry-run first

# No-modify mode, shows what would be repaired
xfs_repair -n /dev/sdX1

Actual repair

xfs_repair /dev/sdX1

Log recovery

XFS replays its journal in the kernel at mount time. If the log is corrupt and mount fails, try mounting and unmounting first to replay it:

mount /dev/sdX1 /mnt
umount /mnt
xfs_repair /dev/sdX1

# LAST RESORT, force log zeroing
xfs_repair -L /dev/sdX1

XFS superblock architecture

XFS has one superblock per Allocation Group (AG). The primary is in AG 0; copies in other AGs serve as backups. Unlike ext4, secondary superblocks are not updated after mkfs.xfs. They may have stale icount/fdblocks values.

# Inspect with xfs_db
xfs_db -c "sb 0" -c p /dev/sdX1     # primary
xfs_db -c "sb 1" -c p /dev/sdX1     # AG 1 backup

xfs_logprint

# Transactional view (for debugging recovery)
xfs_logprint -t /dev/sdX1

# Copy log to file
xfs_logprint -C /tmp/xfs.log /dev/sdX1

Btrfs repair, btrfs check

Read-only check (default, safe)

btrfs check --readonly /dev/sdX1
# or simply:
btrfs check /dev/sdX1

Recovery path (in order of safety)

# 1. Try mount with rescue options (kernel 5.9+)
mount -o ro,rescue=usebackuproot /dev/sdX1 /mnt
mount -o ro,rescue=nologreplay /dev/sdX1 /mnt
mount -o ro,rescue=ignorebadroots /dev/sdX1 /mnt
mount -o ro,rescue=all /dev/sdX1 /mnt

# 2. Extract data with btrfs restore (does not modify filesystem)
btrfs restore -l /dev/sdX1                    # list subvolume roots
btrfs restore -D /dev/sdX1 /target            # dry run
btrfs restore -m -x -S /dev/sdX1 /target      # metadata, xattrs, symlinks
btrfs restore -r <rootid> /dev/sdX1 /target   # specific subvolume

# 3. Last resort: btrfs check --repair
btrfs check --repair --force /dev/sdX1

Rescue mount options (kernel 5.9+)

FAT/VFAT repair, fsck.fat

# Check only
fsck.fat -n /dev/sdX1

# Automatic repair (least destructive approach)
fsck.fat -a /dev/sdX1

# With bad sector test
fsck.fat -t -a /dev/sdX1

# Verbose
fsck.fat -v -a /dev/sdX1

Useful for EFI System Partitions (ESP), which must be FAT32 per the UEFI specification.

Journal recovery

Most "corruption" after an unclean shutdown is just an un-replayed journal. Journaling filesystems replay the journal automatically at mount time and restore consistency, no manual repair needed.

Actual corruption (not just unclean shutdown) is caused by hardware faults, firmware bugs, driver bugs, or something overwriting filesystem structures. These require the repair tools above.

Bad block management

HDDs

# Read-only scan
badblocks -sv /dev/sdX

# Non-destructive read-write scan
badblocks -nsv /dev/sdX

# Destructive write test (wipes all data!)
badblocks -wsv /dev/sdX

SSDs and NVMe

SSDs remap bad blocks transparently at the firmware level. badblocks is largely meaningless on SSDs because logical block numbers don't map to fixed physical locations. Use SMART instead:

# ATA/SATA SMART
smartctl -a /dev/sdX | grep -i reallocated
smartctl -t long /dev/sdX

# NVMe SMART
nvme smart-log /dev/nvme0

Prevention

1. Proper shutdown. Use shutdown -h now or systemctl poweroff; never pull the power cord.
2. UPS: prevents power loss during writes. Configure automatic shutdown on low battery.
3. Journaling. ext4, XFS, Btrfs, and ZFS all journal metadata; ext4 data=journal mode journals data too (at a performance cost).
4. Checksums and scrub. Btrfs and ZFS checksum every block and self-heal from redundancy; schedule monthly scrubs.
5. SMART monitoring. Run smartd with email alerts and replace drives proactively when reallocated sectors grow.
6. Regular backups: the only real protection against catastrophic failure.

Emergency quick reference