Advanced filesystem forensics, subvolume management, and integrity monitoring for Btrfs.
Btrfs Root Hunter is a specialized tool designed for systems engineers, forensic analysts, and security professionals working with the Btrfs filesystem. It provides a robust, interactive interface to discover, monitor, and restore Btrfs subvolumes across any block device.
As a core component of the CDS Host Guardian ecosystem, it serves as the first line of defense for host filesystem integrity.
In a Zero-Trust environment, you cannot trust the host OS if the underlying filesystem is compromised. This tool ensures that:
- Stealth subvolumes are detected.
- Rootfs integrity is verified through checksum-aware subvolume scanning.
- Rapid recovery paths are available via automated snapshot mounting.
- 🛡️ Automated Discovery: Scans all block devices (
/dev/sd*,/dev/nvme*) usinglsblkandblkidto reliably identify Btrfs structures. - 🧩 Interactive Subvolume Manager: A clean, menu-driven interface for mounting, unmounting, and managing snapshots.
- 📸 Snapshot Forensics: Instantly create snapshots of any subvolume for backup or post-compromise analysis.
- 🧹 Atomic Cleanup: Guaranteed removal of temporary mount points even if the script is interrupted.
- ⚙️ Integrated Security: Seamlessly works with
cds-authz-systemto provide full-stack host protection.
btrfs-progsutil-linux(lsblk,blkid,mount)
- Clone the repository:
git clone https://github.com/M0NDsuChTiG/btrfs-root-hunter.git cd btrfs-root-hunter - Set permissions:
chmod +x btrfs-root-hunter.sh
- Run with root privileges:
sudo ./btrfs-root-hunter.sh
Use Btrfs Root Hunter to identify unauthorized subvolumes that may be hiding persistent malware or rootkits outside the standard directory tree.
If your main rootfs is damaged, use the hunter to find and mount recent snapshots to restore system functionality in minutes.
Distributed under the MIT License. See LICENSE for more information.
Part of the CDS Host Guardian security suite.