Recovering 1Tb ext3 with fsck.ext3
 

Hi,

Last night I was moving some files around. I Tarred and GZipped most of the data on one 1Tb partition and stuck the archives on a second 1Tb partition on a separate disk. I then proceeded to format the first partition with NTFS (from Linux.) The only problem is that I completely forgot that I had a CD drive and formatted sdc1 instead of sdd1! I began doing a full NTFS format and after a minute or two I cancelled it and decided to do a quick format. I then realized my mistake.

I managed to find a copy of the superblock and began trying to recover the disk. fsck -t ext3 recognized the partition as NTFS but I luckily didn't have fsck.ntfs installed so it didn't touch it. I managed to get it working with fsck.ext3 (with -b,-B and -y) fsck.ext3 didn't mind that it was an NTFS partition. I have a few questions:

Will this work?

Roughly how long will this take? It's running from Knoppix within a virtual machine to a USB hard drive which is 100% full. Days?

Being that for a few minutes I attempted a full format am I going to end up with a bunch of corrupted archives?

If I do end up with file corruption can anyone recommend a way of recovering the data / sorting it out?

Is it likely to be just a few old files that are corrupt (It's my understanding that filesystems like to keep files in the same area on the disk to minimize the amount of head travel.)

This might just be wishful thinking but as the filesystem fills up will ext3 put the newer files towards the end of the disk? If so then I'm hoping that a full NTFS format starts at the beginning of the disk.

Any help would be greatly appreciated,

Thanks,

Joe

Erk ... some answers, then some observations.

- fsck will work - FSVO "work". However, it is designed to fix filesystems - not (necessarily) files. You might be lucky with your files, maybe not - but you'll have a valid filesystem.
- it'll take forever on USB. I'd have found an internal connector for it.
- hopefully you'll get some useful data back.
- if they are corrupted, they are history.

Nothing should have been done against the "real disk". Image it off to another disk and faff around with that. If that also gets mangled, who cares - re-image and start again.
fsck with "-y" gives you no "out". What Ted decides to do as part of the tool is then cast in (digital) concrete.
A while back I tested formatting over an ext3 (probably with NTFS as it happens), and then used "mkfs.ext3 -S" and proceeded to check if the world still existed. It did; all files were still good - however this was a "new" filesystem with just a few files copied to it prior to the test.

Backups are the only real answer - and if you can accidentally stomp on it, it doesn't meet my definition of a backup.

I would try to use testdisk or foremost to carve whatever archives and files you can out of it. Testdisk might be able to recover partitions.

Thanks for the advice. To install the hard drive internally I'll have to stop fsck and then start it again. Re-checking the partition won't cause any (more) damage will it?

Joe

Writing anything to the drive may cause damage, reading from the drive will not. I personally would NOT run fsck if you just formatted it with NTFS over ext3. Try testdisk first, and see if it can recover the partition.

Stopping fsck will possibly (probably) add to your problems - I would let it run now.
Then try the tools mentioned above - maybe add photorec to the list. They should have been used first, but can't be helped. Note that the recovery will likely take a while too.

Good news! It was some how finished when I got home. It had only been running for about 16 hours. There are a lot of files and folders in the lost and found folder. They all have names like #1234567. The good news is that inside all of these folders everything is named correctly. I watched a TV episode and it didn't seem corrupted and I managed to extract a 6Gb tar.gz archive. I haven't confirmed the integrity of the files extracted from the archive but I assume that it would have failed whilst extracting if it was corrupt. df says that the drive is 68% full, it used to be 99% full but I think that I have most of my important files. When I finish shifting all this data around I'll have to extract some >100Gb archives so that will be the real test.

Thanks for all of the help everyone!

Joe