I need to find a list of the packages that were installed on a Debian (Armbian) sever before it died. Since it's offline, I can't use apt
or dpkg
(or any other command). I need to know which file(s) contain the list (even if they're binary). I tried searching, but everything just says to run the aforementioend commands, which isn't an option.

- 173
1 Answers
How to approximate `dpkg --get-selections` from a backup of /etc and /var? addresses your underlying concern.
The list of installed packages is stored in /var/lib/dpkg/status
. Look for Status: install ok installed
lines — this indicates that the package is correctly installed.
The following AWK invocation will extract the installed package names from a status
file:
awk '/^Package:/ { package = $2 }
/^Status: install ok installed/ { print package }' /path/to/status
If the system supported multiple architectures, you’ll need to keep track of that too:
awk '/^Package:/ { p = $2; i = 0 }
/^Status: install ok installed/ { i = 1 }
i && /^Architecture: all/ { print p; next }
i && /^Architecture/ { printf "%s:%s\n", p, $2 }' /path/to/status
Another interesting file is /var/lib/apt/extended_states
which records the “automatic installation” flag for installed packages. You can restore the flags by running something like
awk '/^Package:/ { p = $2 }
/^Architecture/ { a = $2 }
/^Auto-Installed: 1/ { printf "%s:%s\n", p, a }' /path/to/extended_states |
xargs sudo apt-mark auto
You can combine both files to list the packages that were manually installed, and rely on dependency management to install the automatically-installed packages (although this won’t necessarily result in the same set of packages being installed):
awk 'FNR == NR && /^Package:/ { p = $2 }
/^Status: install ok installed/ { i = 1 }
FNR == NR && i && /^Architecture: all/ { ps[p] = 1; next }
FNR == NR && i && /^Architecture/ { ps[p ":" $2] = 1}
FNR != NR && /^Package:/ { p = $2 }
FNR != NR && /^Architecture:/ { a = $2 }
/^Auto-Installed: 1/ { delete ps[p ":" a] }
END { for (p in ps) print p }' /path/to/status /path/to/extended_states
See the “FILES” section in man dpkg
:
/var/lib/dpkg/status
Statuses of available packages. This file contains information about whether a package is marked for removing or not, whether it is installed or not, etc.

- 434,908
/var/lib/aptitude/pkgstates
or/var/cache/debconf/config.dat
fit in the picture (wasn't there adselect
one as well before?). The list of installed packages can also be derived from the contents of/var/lib/dpkg/info
(print -rC1 - /var/lib/dpkg/info/*.list(:t:r)
in zsh for instance) – Stéphane Chazelas Jun 15 '21 at 14:01/var/lib/aptitude/pkgstates
is only used byaptitude
./var/lib/apt/extended_states
seems more relevant ;-). Thedebconf
file is only used bydebconf
-enabled packages. There might have been adselect
state file but I’m not sure there are manydselect
users nowadays.../var/lib/dpkg/info
can be misleading, files can survive there even though the corresponding packages are gone. – Stephen Kitt Jun 15 '21 at 14:06/var/log/apt/history.log
looked promising, but it only has the last command, and/var/log/apt/eipp.log.xz
seems to just be a generic list of all packages including dependencies.) Dependencies can be automatically removed when the main package is removed, so ostensibly, there's a flag or something to indicate that. – Synetech Jun 15 '21 at 14:21extended_states
. I can update my answer to explain how to combine the two files to get a list of non-automatically-installed packages; but restoring that won’t necessarily produce the same system state as you’d get by restoring all the packages listed in/var/lib/dpkg/status
. – Stephen Kitt Jun 15 '21 at 14:29Pi-hole
. I installed that withoutapt
(directly from their website), are programs installed that way listed anywhere? (In my case, it shouldn't matter because I think that was the only one, but others that might find there way here might have more installed that.) – Synetech Jun 15 '21 at 15:10dpkg
only knows about packages, not programs which are installed “directly”. There’s no standard way of finding such programs; you’d have to look at the contents of/usr/local
,/opt
etc. and hope the program didn’t install itself in system-owned directories (/usr/bin
etc.). – Stephen Kitt Jun 15 '21 at 15:21