Ships as part of e2fsprogs. Already installed on every Linux box running ext2/3/4. Almost nobody uses it interactively — which is a shame, because it's the only tool that lets you talk to your filesystem at the inode level without loading a kernel module.

The problem: You rm -rf'd the wrong directory. Or the filesystem won't mount. Or you want to know which file owns a specific physical block. Standard tools give up; debugfs shrugs and asks what you want next.

# Open a filesystem read-only (default — you want this)
debugfs /dev/sda2

debugfs:  ls -l /var/log
debugfs:  stat <12345>      # inspect inode 12345 directly
debugfs:  icheck 542         # which inode owns physical block 542?
debugfs:  ncheck 12345       # what pathname(s) point at inode 12345?

Undelete recently deleted files. Works if the inode hasn't been reused yet:

debugfs -w /dev/sda2         # -w for write mode

debugfs:  lsdel              # list deleted inodes with size + deletion time
 Inode  Owner  Mode    Size   Blocks  Time deleted
 12456   1000  100644  4096   1/1     Fri Jul 24 22:14:07 2026

debugfs:  dump <12456> /tmp/rescued.txt

Read a specific block off disk without mounting — useful when the filesystem is too corrupted to mount, or you want to see what's really on the platter:

debugfs:  dump_extents <12345>    # show extent tree of a file
debugfs:  bd 542                  # block dump — hex+ASCII of block 542
debugfs:  logdump                 # dump the ext journal

See superblock, group descriptors, fragmentation:

debugfs:  stats -h                # superblock in human-readable form
debugfs:  ffb 20                  # find 20 free blocks
debugfs:  freefrag                # fragmentation histogram

Scripted use — where it beats poking around live:

# Which physical block backs logical block 128 of /var/log/syslog?
debugfs -R "bmap <$(stat -c %i /var/log/syslog)> 128" /dev/sda2

# Every deleted inode, sorted by deletion time
debugfs -R lsdel /dev/sda2 | sort -k6

# Dump a file's raw contents by inode when the path is corrupt
debugfs -R "dump <12345> /tmp/recovered" /dev/sda2

Why not extundelete or ext4magic? They're wrappers around the same primitives — they parse debugfs output. When they fail with cryptic errors, you drop to debugfs and drive it yourself. When your corruption is weirder than their heuristics handle, debugfs still opens the volume.

Compared to the mainstream fix: most guides tell you to unmount, run e2fsck -y, and pray. Debugfs lets you inspect first, decide then. With -c (catastrophic mode) it can open filesystems that fsck refuses to touch, so you can pull data off before ordering the replacement drive.

Handy flags: -c catastrophic (skip block group descriptor validation), -b BLOCKSIZE for old filesystems, -s SUPERBLOCK to use a backup superblock when the primary is trashed (try 32768, 98304, 163840 — mke2fs -n tells you the exact offsets without touching anything). Combine with -R "cmd" to run one command and exit — makes it pipeable.

The XFS folks have xfs_db, the ZFS folks have zdb. Every serious filesystem ships one of these. Ext's is the oldest and best-documented — info debugfs reads like a real manual.