LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices


Reply
  Search this Thread
Old 09-06-2010, 12:20 PM   #1
Xotli
Member
 
Registered: Jun 2010
Posts: 42

Rep: Reputation: 15
Reconstructing a mangled file system


(Hmmm ... it doesn't seem like Linux - General is the right place for this, but I don't see a better one. Suggestions welcome.)

Okay, so, a few months ago an install-gone-wrong completely trashed both my original disks and my backup disk. If you want the whole gory story, you can read about it, but at this point I've decided that it probably doesn't matter so much how it happened. I've come to accept that there is no quick way to fix this. So now I'm moving on to the slow way.

I'm using hexedit and doing simple text searches. I've recovered a few of the most crucial files, and, after having my life consumed by my computer troubles for a while, my computer troubles got consumed by my life, and I'm just now getting back to this issue. Here's my situation: while searching for files, I've occasionally run across a directory. So the directories are there. I've seen them. And, through various other things I've tried, I feel moderately confident that the inode table is still around, somehow or another. So there's no reason why I couldn't hack together a script or two and read this puppy all day long. I should theoretically be able to recover the entire tree, if I can find a directory entry close enough to the root dir.

What I'd like to know is, what are the resources I can take advantage of to reconstruct the tree from the raw bytes of the disk image? I need to know where to find the ext2 directory structure (like a C struct, I mean) and then I should be able to pick out a block that contains a dir, get the filenames, dates, indoes, etc, and then I can look for the next step of figuring out how to turn an inode number into a disk sector.

I know this is doable. I just need a little help to get started.
 
Old 09-06-2010, 06:27 PM   #2
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 21,126

Rep: Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120
G'day again - pull up a comfy chair and have a read of this for some mighty good info.
There is mention of a google groups list - not sure how active it still is, haven't looked in a while.

Something else of interest may be this, but seems to require a valid journal. Haven't seen this one before - must try to find some time to test it.
 
Old 09-06-2010, 10:47 PM   #3
Xotli
Member
 
Registered: Jun 2010
Posts: 42

Original Poster
Rep: Reputation: 15
Quote:
Originally Posted by syg00 View Post
G'day again - pull up a comfy chair and have a read of this for some mighty good info.
There is mention of a google groups list - not sure how active it still is, haven't looked in a while.

Something else of interest may be this, but seems to require a valid journal. Haven't seen this one before - must try to find some time to test it.
Okay, I'm going to try to go through that and see what I can get out of it. It looks like there's some good info, although this statement:

Quote:
The tool that I wrote assumes a spike of recently deleted files (shortly before the last unmount). It does NOT deal with a corrupted file system, only with accidently deleted files.
is a bit discouraging. But it does look like I can bastardize some good stuff from here. Oh, and mine is ext2, not ext3 ... should I be concerned about that? I know the FSes are very close, but I'm not sure how/where they diverge.

Thanx for the quick reply!
 
Old 09-06-2010, 11:02 PM   #4
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 21,126

Rep: Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120
ext3 is just ext2 with a journal - underlying structure is the same.
 
Old 09-07-2010, 01:11 PM   #5
Xotli
Member
 
Registered: Jun 2010
Posts: 42

Original Poster
Rep: Reputation: 15
Quote:
Originally Posted by syg00 View Post
ext3 is just ext2 with a journal - underlying structure is the same.
Right, but if I'm going to be reading the individual bytes of individual blocks--and it looks like I will be!--I'll be sensitive to even very slight differences.

Well, maybe I'm overworried about it ... after all, I'm probably not going to use every byte I read. As long as the big things are in the same places I'm sure it won't make a whit of difference which digit follows the ext. Okay, let me get cracking on some of the tools outlined on that page.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
reconstructing the original source tree for Fedora 8 dar_beh_dar Linux - Kernel 2 05-05-2009 01:27 AM
reconstructing an ext3 filesystem? yello Linux - Server 2 12-13-2007 01:01 PM
characters are mangled up sonaht Linux - Newbie 4 11-12-2004 01:24 AM
Reconstructing Lilo Bootloader to boot triple OS's dolphans1 Mandriva 2 10-26-2004 04:30 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - General

All times are GMT -5. The time now is 07:53 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration