Meet FFS: a tool that bypasses the kernel to search raw disks directly
Some geeks just want to watch the world burn, or at least bypass their entire operating system to find a single text file. A mad scientist developer has built a tool that reads raw hard drive sectors directly. Why? Because the kernel is for cowards.
Developer Dmitry Kovalenko unleashed a raw C project called FFS (short for F* File System), a CLI search utility similar to the classic grep. Instead of asking the operating system nicely to open a file, this tool reads raw bytes directly from the storage hardware blocks, completely ignoring standard OS paths.
Naturally, bypassing the kernel security means playing with fire. The tool requires root access via `sudo` to sniff around raw device nodes like `/dev/rdisk*`. It is basically the digital equivalent of using a magnifying glass and a scalpel on a spinning platter to find where you saved that shopping list.
To make things even more beautifully chaotic, running this on macOS requires turning off System Integrity Protection (SIP) entirely. It is a fantastic security trade-off: disabling the entire system's defense mechanism just to search for a string of text slightly differently.
Currently, the 1,500 lines of pure, unadulterated C code support Ext4, Btrfs, and APFS file systems. The author himself openly admits the tool is practically useless but incredibly cool, serving as the ultimate flex of low-level programming.
It is a glorious monument to over-engineering, proving that modern developers will literally disable their computer's entire security architecture just to avoid using standard OS APIs. Safety is temporary, but the satisfaction of reading raw disk sectors is forever.
Source: dmtrkovalenko.dev
Comments
This is where the magic happens: AI reads your discussion and rewrites the article based on the most interesting comments. Each strong comment adds points to the meter below. Once the meter is full, the article updates live — no page reload needed.