corrupted ext2 filesystem on usb flash drive
 

Just fubar'd my usb flash drive and want to understand, if possible, what happened, so as to avoid future repeats.

The flash / thumbnail drive is a Kingston 8G, about 2 - 3 years old. Shortly after purchasing it, I partitioned it as per this fdisk report:Earlier today I took it to a local photocopy place here in Nicaragua to have a document scanned, and gave the flash drive to the girl to copy the scanned pdf file onto it. She copied the pdf file to the FAT32 partition and I'm able to read that partition fine.

When I got back home and started my old Dell running an old Linux (Debian/Mepis) with the flash drive plugged in, I could mount the Linux partition and see the various directories and files, but was getting read errors. When I unmounted the partition and ran e2fsck, I got so many errors that i aborted and ran e2fsck again with the -y option to automatically answer Yes to fix all errors. Now I was unable to even mount the drive; the superblock was now apparently corrupted. Re-running e2fsck still reported a corrupted filesystem and reported what appeared to be the same errors that the first run had reportedly fixed.

Then I rebooted to a newer Mepis and tried using that e2fsck with the -y switch. This time e2fsck fixed the same(?) problems and left me with a clean drive which i can mount and read. But all my directory structures are gone and all data now resides in numbered files within the lost+found directory. All the data appears to be there, but it will be an impossible task to try to match the numbered files in lost+found to my original directory structure and filenames. (Plus, many of the numbered files have strange files permissions.) The mess is unrecoverable, and I will have to reformat the whole partition and rebuild all my data from scratch.

Perhaps (?) the photocopy place's Windows system, failing to recognize the second partition, had prompted the girl to format that partition, and she clicked 'OK' and then aborted the format when she realized her mistake. This is pure speculation on my part. The filesystem was not reformatted; it is still a type 83 Linux partition and somewhere there still exist the directories and filenames pointing to the old inode numbers. Why and how did e2fsck further corrupt everything? What ought I to have done instead of e2fsck?

Windows should not have seen the second partition easily I'd think.

ext2 is kinda bad for a usb I'd think unless you have no other choice. Switch to ext4.

I'd suspect that esd or some voltage issue/unplugged hot caused it.

Guess it could be some malware. Those public places are subject to a wide array of problems.

Drive could be going bad.

Thank you for your thorough reply.

I think that was true a few years ago, which was one big reason i partitioned the drive as i did - to protect my important data from public Windows computers. Depending upon how it's configured (I guess), the newer Windows can see the second partition but can't read it, and therefore prompts the operator to format it.
For now, I need it to be compatible with my 10-year-old Linux Mepis system. But will look into this possibility when i buy a new drive. Ext3 is also a journaled system, no? Or what about formatting as Reiser?
I NEVER unplug it hot. Perhaps the operator did. (What is 'esd'?)
Yes. Am trying to wean myself of cyber cafes, etc, but that ain't easy down here in Nicaragua.
A possibility.

Taking all into consideration, probably my best option is to buy another new stick and use it exclusively for my Linux backups that never leaves home. I already have a second backup stick - or, rather, the one that went bad was my second, so no panic issue. And then reformat the corrupted one as FAT32 for exclusive public transfer use.

Still no clue as to what went wrong with the e2fsck process, why it corrupted the filesystem even worse than it was originally. It was a 10-year-old (or older?) e2fsck, part of my old Mepis(Debian) system. Any thoughts on that?

That sounds like a good strategy to me.

Out of interest, can I ask why you marked the thread as "Solved" when the cause of the problem hasn't yet been determined? It means that some folk who may be able to add further observations might avoid reading the thread as they think that the issue has been resolved.

Marked it as Solved after post #3 above, when I had arrived at the aforementioned strategy for avoiding future problems. Post #4 was an afterthought.

But you're right, it would still be good to learn what went wrong with the e2fsck process. Will try to remove the 'Solved' tag from this thread, if I can.

When you have lost your boot blocks there are other super blocks that you can use to replace the faulty one, which then allows complete access to your data again.

(About half way down the page.)
https://www.slashroot.in/understandi...perblock-linux

ext2 stunk and it had/has very few ways to correct from disaster.

Flash drives are unreliable.

Taking storage to unknown locations is a recipe for disaster.