Filesystem signatures and wipefs · Linux

When the kernel sees a block device, it does not run a full filesystem check just to know what is on it. Instead, it reads a tiny marker called a filesystem signature at a known offset. The signature says “this is an ext4 filesystem” or “this is a swap partition” or “this is nothing”.

How signatures work

Read-only / Safeblkid output— blkid shows the signature-detected type. sda1 is ext4, sda2 is an LVM physical volume, sdb is a bare disk with a GPT signature only. The kernel reads these markers to determine what to do with each device.

$ blkid /dev/sda1 /dev/sda2 /dev/sdb

/dev/sda1: UUID="1a2b-3c4d" TYPE="ext4" PARTUUID="abcd-ef12-3456-7890"
/dev/sda2: UUID="5e6f-7a8b" TYPE="LVM2_member" PARTUUID="fedc-ba09-8765-4321"
/dev/sdb: PTUUID="aaaabbbb" PTTYPE="gpt"

Wiping a signature before reuse

When repurposing a disk, the old filesystem signature can confuse the kernel. The new filesystem’s signature overwrites the old, but ghost signatures in the partition table can linger. wipefs removes the detected signature - but only when you ask it to.

Read-only / Safewipefs list mode— No options means list mode. Nothing is written, nothing is erased, and it works happily on a mounted filesystem. This is the form to use when you are still deciding.

$ wipefs /dev/sda1

DEVICE OFFSET TYPE UUID                                 LABEL
sda1   0x438  ext4 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d data

Illustrative output

To actually erase, use -a (all signatures) and -b (write a restorable backup of each one first):

Data-loss riskwipefs erase mode, device in use— Erase mode takes an exclusive open, so it refuses while the filesystem is mounted. Unmount first. Never reach for -f to work around this - forcing a wipe of a live filesystem is how you take a running service down.

# wipefs -a -b /dev/sda1

wipefs: error: /dev/sda1: probing initialization failed: Device or resource busy

On an unmounted device the same command erases every magic string libblkid can see, rescanning after each erase until none remain, and drops one backup file per signature into $HOME:

Data-loss riskwipefs erase mode— -a erases all detected signatures; -b wrote ~/wipefs-sdb1-0x00000438.bak first. Add -n (--no-act) to do everything except the write - a genuine dry run.

# wipefs -a -b /dev/sdb1

/dev/sdb1: 2 bytes were erased at offset 0x00000438 (ext4): 53 ef
/dev/sdb1: calling ioctl to re-read partition table: Success

Illustrative output

The dangers of wipefs

The same power that makes wipefs useful for repurposing a disk makes it dangerous on a disk you actually wanted:

wipefs on the wrong disk removes the only thing that tells the kernel what filesystem is there. The data is intact, but mount cannot find the filesystem.
wipefs on a partition that contains a database wipes the filesystem signature. The data is recoverable with time and forensic tools, but the service is down.
wipefs is not the same as dd if=/dev/zero. The latter erases data; wipefs only removes the signature.

Always verify before wiping

Production discipline: always run blkid, or bare wipefs, first to confirm what is on the device. If the output is unexpected, stop. Then wipefs -n -a for a real dry run, and only then the erase.

wipefs does have an undo, but only if you planned for it. wipefs -a -b DEVICE writes ~/wipefs-<devname>-<offset>.bak for every signature it removes. Restore one with the byte-exact copy the man page documents:

dd if=~/wipefs-sdb-0x00000438.bak of=/dev/sdb \
   seek=$((0x00000438)) bs=1 conv=notrunc

conv=notrunc is the load-bearing part: it stops dd truncating everything after the offset. Without -b there is no undo, and the recovery really is “restore from backup” - hours of outage instead of seconds. Make -b a habit, not a decision.

How signatures work

Wiping a signature before reuse

The dangers of wipefs

Knowledge check