wiredtiger file forensics wt dumpThis article contains one normal section – how to print information directly from the raw WiredTiger files using wt dump – followed by really important, otherwise undocumented information about how to get to the MongoDB binary data inside WT tables.

See “WiredTiger File Forensics (Part 1: Building “wt”)” for:

  • How to build the “wt” utility command
  • A short description of its commandline syntax
  • How to set the wiredtiger_open() configuration string it needs

The examples in this page assume the following:

  • WiredTiger.config or WIREDTIGER_CONFIG or the -C option is being used to give “wt” the right config string. Having said that – an empty “wt” config might work OK for you, at least until wt printlog.
  • xxd, bsondump, jq are installed. (See “Shell script formatting tricks” section for why.)

[porto_content_box border_top_color=”” border_top_width=”2″ bg_bottom_color=”red” align=”left”]⚠ Warning: the “wt” tool usually opens files in read-write mode, even for commands you’d think would be read-only. It will automatically step through its normal recovery process most of the time, so it may change files.

Until you know its effects on data files do not use it on your only copy of precious data – make a copy of the data directory and learn with the copy first.[/porto_content_box]

wt dump

The wt dump command can be used to show the full content of a WiredTiger table file. It will output the table object’s header then every key and value.

wt dump has one compulsory argument: uri. A uri is usually “table:” + WT ident string, or “file:” + (relative) file path. Eg. “table:collection-4–9876544321″ or “file:collection-4–9876544321.wt“.

“table:” is automatically prepended to the uri by wt dump if you don’t specify any type yourself.

Documentation at source.wiredtiger.com

The format from wt dump can be:

  • “print”: Keys and values will be strings of printable ascii chars and -escaped hex values of non-printable bytes. (A.k.a. pretty-print.)
    Eg. 82