Inspect an Initramfs Safely with lsinitramfs

Before you rebuild an initramfs to chase a missing driver, check with lsinitramfs whether it was ever in there. It lists the files inside an image without unpacking or changing it. This guide covers listing files, a detailed listing, and comparing images, useful when checking for a driver, firmware file, hook output or configuration fragment. Allow about ten minutes if you already know which image you want to inspect.

The examples use lsinitramfs from initramfs-tools-core version 0.142ubuntu25.8, installed on Ubuntu on this machine. The command only reads the image in these examples. You normally do not need elevated privileges for an image that your account can read.

1. Confirm the command and choose an image

Start by checking which executable will run and which initramfs files are available. This avoids inspecting a similarly named file from the wrong directory or assuming that the running kernel is the newest installed kernel.

$ command -v lsinitramfs
/usr/bin/lsinitramfs
$ dpkg-query -W -f='${Package} ${Version}\n' initramfs-tools-core
initramfs-tools-core 0.142ubuntu25.8
$ find /boot -maxdepth 1 -type f -name 'initrd*' -printf '%f\n'
initrd.img-6.8.0-139-generic
initrd.img-6.8.0-142-generic

Your file names and package version will differ. To inspect the image used by the currently running kernel, construct its path from uname -r and check that it exists before running the listing:

$ image="/boot/initrd.img-$(uname -r)"
$ test -r "$image" && printf 'readable: %s\n' "$image"
readable: /boot/initrd.img-6.8.0-142-generic

Checkpoint: do not continue until $image names the specific image you intend to inspect. If the test prints nothing, check the kernel name and the files in /boot. Use sudo only if the image is present but your account cannot read it. Do not make the file world-readable just to get around a permission problem.

2. List the archive contents

Pass one or more initramfs paths to the command. With no options, it prints names from the image, one entry per line. The command does not extract those entries into your current directory.

$ lsinitramfs "$image" | sed -n '1,20p'
.
kernel
kernel/x86
kernel/x86/microcode
kernel/x86/microcode/AuthenticAMD.bin
kernel
kernel/x86
kernel/x86/microcode
kernel/x86/microcode/.enuineIntel.align.0123456789abc
kernel/x86/microcode/GenuineIntel.bin
.
usr
usr/lib
usr/lib/firmware
usr/lib/firmware/3com
usr/lib/firmware/3com/typhoon.bin.zst
usr/lib/firmware/acenic
usr/lib/firmware/acenic/tg1.bin.zst
usr/lib/firmware/acenic/tg2.bin.zst
usr/lib/firmware/adaptec

The exact entries depend on the kernel, installed packages and initramfs configuration. A short first page is easier to scan than sending a large archive listing straight to the terminal. To search the complete listing for a name, use a case-sensitive pattern and keep the exit status visible:

$ lsinitramfs "$image" | grep -F 'firmware'
lib/firmware
$ printf 'listing status: %s\n' "${PIPESTATUS[0]}"
listing status: 0

The status belongs to lsinitramfs, not to grep. A successful command with no matching line is not the same as a failed archive read, so do not infer absence from a pipeline's final status alone. If you need to distinguish no match from an archive error, save the listing to a temporary file and check each command separately.

3. Request the long listing

Use -l when names alone are not enough. The option asks for a longer, more verbose listing of the archive contents, useful when you need metadata such as the stored mode, owner or size while investigating why a boot file is not behaving as expected.

$ lsinitramfs -l "$image" | sed -n '1,12p'
drwxr-xr-x   2 root     root            0 Dec  2  2025 .
drwxr-xr-x   2 root     root            0 Dec  2  2025 kernel
drwxr-xr-x   2 root     root            0 Dec  2  2025 kernel/x86
drwxr-xr-x   2 root     root            0 Dec  2  2025 kernel/x86/microcode
-rw-r--r--   1 root     root       304866 Dec  2  2025 kernel/x86/microcode/AuthenticAMD.bin
drwxr-xr-x   2 root     root            0 Nov  3  2025 kernel
drwxr-xr-x   2 root     root            0 Nov  3  2025 kernel/x86
drwxr-xr-x   2 root     root            0 Nov  3  2025 kernel/x86/microcode
drwxr-xr-x   2 root     root            0 Nov  3  2025 kernel/x86/microcode/.enuineIntel.align.0123456789abc
-rw-r--r--   1 root     root     14799872 Nov  3  2025 kernel/x86/microcode/GenuineIntel.bin
drwxr-xr-x   9 root     root            0 Sep 23 08:36 .
drwxr-xr-x  10 root     root            0 Sep 23 08:36 usr

Output formatting and timestamps are image-specific: treat the example as a shape, not as a fixed transcript. The long form does not unpack files or repair their permissions on disk. If the output is very large, redirect it to a new temporary or working file instead of overwriting an existing report:

$ report="$(mktemp)"
$ lsinitramfs -l "$image" > "$report"
$ status=$?
$ printf 'status: %s, lines: ' "$status"
$ wc -l < "$report"
status: 0, lines: 2001

After reviewing the report, remove only the exact temporary path you created: rm -- "$report". That removal is optional and irreversible. If the report contains sensitive file names, handle it as host data and do not paste it into a public issue without review.

4. Compare two initramfs images

The command accepts multiple image paths in one invocation. This is a quick way to confirm that two kernel images contain a similar high-level set of entries, but the output does not label every line with the file it came from. Run each image separately when attribution matters.

$ old=/boot/initrd.img-6.8.0-139-generic
$ new=/boot/initrd.img-6.8.0-142-generic
$ lsinitramfs "$old" | sed -n '1,8p'
$ lsinitramfs "$new" | sed -n '1,8p'
$ lsinitramfs "$old" "$new" > /tmp/initramfs-two-images.txt
$ printf 'status: %s\n' "$?"
status: 0

For a useful comparison, create separate listings and use ordinary text tools:

$ lsinitramfs "$old" > /tmp/initramfs-old.txt
$ old_status=$?
$ lsinitramfs "$new" > /tmp/initramfs-new.txt
$ new_status=$?
$ if [ "$old_status" -eq 0 ] && [ "$new_status" -eq 0 ]; then
>     diff -u /tmp/initramfs-old.txt /tmp/initramfs-new.txt
> fi

A difference is expected after a kernel or package update: it is evidence to investigate, not proof that either image is broken. Do not replace an initramfs merely because its listing differs. If you later regenerate one, use your distribution's documented update-initramfs workflow and keep a known-good boot entry available.

5. Handle failures without guessing

If the image path is wrong or unreadable, the command reports an error and returns non-zero. Check the path and permissions without changing them:

$ ls -l -- "$image"
$ test -r "$image"; printf 'read test: %s\n' "$?"
-rw-r--r-- 1 root root 76273231 Sep 23 08:36 /boot/initrd.img-6.8.0-142-generic
read test: 0

If the file is readable but listing fails, it may not be an initramfs image, it may be incomplete, or its compression format may not be supported by the installed tooling. Preserve the original file while you investigate. Do not run a decompressor over it in place and do not redirect output back to the same path.

The manual documents one specific limitation: multiple-segmented initramfs images are not handled, except where an early uncompressed initramfs containing system firmware is prepended to the regular compressed initramfs. A failure with such an image is not repaired by adding -l. Identify how the image was built, then use a tool intended for that layout or inspect a copy.

-h displays usage information and exits. It is safe when you need to confirm the two available options:

$ lsinitramfs -h
Usage: lsinitramfs [-l] initramfs-file...

Options:
  -l   Display long and more verbose listing of initramfs content

Done means