Recovering data from an ext3 fs with no superblocks
Hi all, big problems, hopefully you can help. I accidently killed my HD and am trying to recover some important files <scorn>insert comment about no backup = stupid</scorn>.
Computer: is a 686 with 150GB dual boot: mandrake and winxp.
1: winxp (ntfs)
2: fat32 transfer between linux and winxp
3: winxp (ntfs)
4a: ext3 (/)
4c: ext3 (/home)
Symptom: One day I booted, the fsck squawked and locked up. It then said something to the effect of "do you want to try to rescue the partition?" Like a dope (second time this post) I said "sure." It popped up some sort of tool (diskdrake?) to fix the partition. I selected the root partition and said ok. The root partition is fine, but all the others were killed. So far so bad. I need data off the /home partition. I have not written to the disk since (first smart thing I did all day!) I made an image and that's what I've been trying things on (I used dd with noerror,sync,notrunc to make the image).
I tried to e2fsck and fsck.ext3 the image. Both bailed out with a message about no superblock and bad magic numbers. I tried the standard backup superblocks with the -b option. No luck. It didn't seem reasonable that I should have lost all my superblocks, so I figured that I must have somehow "slid" the start of the partition and that the superblock was not 1024 bytes into the record but somewhere else. I tried e2salvage. nada. I tried e2 superblock find (e2sbf) which basically tries every possible location for the superblock with e2fsck. nothing. I tried mke2fs -S to write a superblock on the image and then e2fsck. no data. The kicker is if I hex edit the image, I can very clearly see the data and directories. I have used the strings command to dump all the text in the partition, but since its a 50GB partition, that is going to be a lot of editing, and Im not sure what file was what without the filenames (which of course aren't in the files).
Other programs I've tried: Acronis recovery expert, Stellar Phoenix, R-Studio, R-Linux, FileScavenger 2.1, Recover2000. No luck
I have come to the conclusion that all my superblocks are trashed or at least so corrupted that e2fsck doesn't recognize them. I have also come to the conclusion that most of my data is still in there if I could only get it out.
Basically my question is this: is there a program that will read the partition without a superblock, or that I can tell what the superblock values should be? If I can figure out the inode for my file, is there a program that will read the inode for me (again without a superblock). If I can't find the inode table, is there a program/script that can find it for me?
I know I should have backed up the disk sooner. Lifes tough, its tougher if your stupid. Please help me make life stop sucking!
Last edited by UncleTaz; 03-03-2004 at 10:10 PM.