hfsdebug: Command-line Options

hfsdebug-lite (version 4.33) Copyright (c) 2004-2010 Amit Singh (osxbook.com). All Rights Reserved. A read-only debugger for HFS Plus file system volumes. Usage: hfsdebug-lite PATH example: hfsdebug-lite /mach_kernel hfsdebug-lite OPTION ... example: hfsdebug-lite -V /Volumes/Foo -j In its simplest form, hfsdebug-lite accepts one argument: a path to a file or a folder about which it prints all information it can retrieve from the "raw" file system. hfsdebug-lite also accepts the following options: -0, --freespace display all free extents on the volume -b BTREE, --btree=BTREE specify an HFS+ B-Tree, where BTREE is one of "attributes", "catalog", "extents", or "hotfile" -c CNID, --cnid=CNID specify an HFS+ catalog node ID -d DEVICE, --device=DEVICE specify an HFS+ volume's raw device node -e, --examples display some usage examples -f, --fragmentation display all fragmented files on the volume -F CNID:NAME, --fsspec=CNID:NAME specify parent's catalog node ID and a node name -h, --help print this help message and exit -H, --hotfiles display the hottest files on the volume; requires the -t (--top=TOP) option for the number to list -j, --journalinfo display information about the volume's journal -J, --journalbuffer display detailed information about the journal -l TYPE, --list=TYPE specify an HFS+ B-Tree's leaf nodes' type, where TYPE is one of "file", "folder", "filethread", or "folderthread" for the Catalog B-Tree; one of "hfcfile" or "hfcthread" for the Hot Files B-Tree B-Tree; or "extents" for the Extents B-Tree You can use the type "any" if you wish to display all node types. Currently, "any" is the only type supported for the Attributes B-Tree -m, --mountdata display a mounted volume's in-memory data -p PATH, --path=PATH specify a POSIX path (must be on a mounted volume) -P PATH, --path_abs=PATH specify an absolute POSIX path. Works even on unmounted volumes -s, --summary calculate and display volume usage summary -S, --summary_rsrc calculate and display volume usage summary -t TOP, --top=TOP specify the number of most fragmented files to display (when used with the --fragmentation option), or the number of largest files to display (when used with the --summary option) --version display version information and quit -v, --volumeheader display information about the volume's header -V VOLUME, --volume=VOLUME specify an HFS+ volume, where VOLUME is its mount point. VOLUME may also be the path of any file within the volume -x FILTERDYLIB, --filter=FILTERDYLIB run the filter implemented in the dynamic library whose path is FILTERDYLIB. Alternatively, FILTERDYLIB can be 'builtin:<name>', where <name> specifies one of the built-in filters: atime, crtime, dirhardlink, hardlink, mtime, and sxid -X FILTERARGS, --filter_args=FILTERARGS pass this argument string to the filter callback If you do not specify a volume using the '-V' or the '-d' options, hfsdebug-lite tries to determine the volume from a PATH specifier, if present, failing which the root volume is used by default. Note that hfsdebug-lite requires read-only access to the raw device corresponding to an HFS+ volume, and may need to be run as the super-user for certain volumes (such as the root volume). Please report bugs using the following contact information: <URL:http://www.osxbook.com/software/bugs/>.