F* file system – file search that reads SSD directly bypassing OS kernel

2026-06-21 | original

read original more articles

Why This Matters

The F* File System (FFS) introduces a novel approach to file searching by reading disk blocks directly, bypassing the OS kernel. While primarily a proof-of-concept, this technique highlights potential for faster searches on large datasets and unmounted volumes, offering insights into low-level disk access and custom file system interactions that could influence future storage and search technologies.

Key Takeaways

FFS reads disk blocks directly, bypassing the OS kernel for faster searches.
It can search unmounted volumes by parsing binary blobs, expanding search capabilities.
Supports multiple file systems like Ext4 and Btrfs, demonstrating versatility in low-level disk access.

FFS - F* File System

This is a cli tool for searching files (like grep) that does not use the OS kernel to read files, but reads your disks directly. It is practically useless, but insanely cool.

this is just ~1.5k lines of C code that:

requires sudo only when reading a raw device node (e.g. /dev/rdisk* ); searching an image file needs no elevated permissions

); searching an image file needs no elevated permissions requires disabling SIP protection to run on the main macOS disk

can miss some recent file writes (will require a manual sync call)

call) might not be able to search trees on a highly volatile file system while other system components are writing files in the OS

works only for file systems implemented manually in this project

but at the same time

directly reads blocks from your disks

... continue reading

Explore topics: ffs ext4 ssd raw device macos