Any way to dump ext4 filesystem without file data blocks? (for later analysis)

Any way to dump ext4 filesystem without file data blocks? (for later analysis)

[Filip Štědronský]

Hello,

I have experienced several mysterious ext4 issues on remote machines
with poor internet connection (mobile broadband) that are not easily
physically accessible.

I would like to download the filesystem image from the remote machine
for local investigation but the partition is rather large (500GB in
one instance) and I cannot easily upload that much data over the
mobile connection.

Is there any way to extract only filesystem metadata (superblock,
inodes, directory data blocks, etc.) from the partition but not
file data blocks? Ideally so that I could then reconstruct an
identical filesystem image, only with file data blocks zeroed out.

It seems it should be straightforwad to write such a tool but before
I start doing so, I wanted to check whether somebody hasn't already
written one. (It seems this might be a common enough need when
debugging and developing filesystems.) Short googling around and
searching list archive did not reveal anything.

Thanks for any pointers.

Filip Stedronsky

Re: Any way to dump ext4 filesystem without file data blocks? (for later analysis)

[Lukas Czerner]

On Thu, Apr 30, 2020 at 03:44:09PM +0200, Filip Štědronský wrote:
> Hello,
> 
> I have experienced several mysterious ext4 issues on remote machines
> with poor internet connection (mobile broadband) that are not easily
> physically accessible.
> 
> I would like to download the filesystem image from the remote machine
> for local investigation but the partition is rather large (500GB in
> one instance) and I cannot easily upload that much data over the
> mobile connection.
> 
> Is there any way to extract only filesystem metadata (superblock,
> inodes, directory data blocks, etc.) from the partition but not
> file data blocks? Ideally so that I could then reconstruct an
> identical filesystem image, only with file data blocks zeroed out.
> 
> It seems it should be straightforwad to write such a tool but before
> I start doing so, I wanted to check whether somebody hasn't already
> written one. (It seems this might be a common enough need when
> debugging and developing filesystems.) Short googling around and
> searching list archive did not reveal anything.
> 
> Thanks for any pointers.
> 
> Filip Stedronsky

Hello Filip,

indeed there is a tool exactly for this purpose. It is called e2image
and it's part of the e2fsprogs. The manual page also have some useful
examples of how to use it.

Good luck.

-Lukas