Okay. I'm having a major problem with my Linux computer. It has four filesystems: boot, swap, root, and usr (in that order). The boot and root filesystems are ext2. I never got around to upgrading. Yesterday, I had to shut it down so that I could do some electrical work. I did an orderly shutdown (sudo /sbin/shutdown -h now). After I hooked the power back up, I tried to turn the computer back on. It booted fine and then told me that the drive was unmounted incorrectly. It ran e2fsck. E2fsck finished and asked for a root password. I hit ctrl-d to skip that step and reboot. It rebooted, but it gave me a ton of unrecoverableerrors. Then there was a kernel panic because it couldn't mount the root filesystem and couldn't find init. When I ran e2fsck from Knoppix (and RH9 rescue mode), it failed with a "Read too short error." I DO have a backup, but it isn't up to date. I need to recover about 10 files off of this disk for sure, but I'd like to have it ALL back. Any ideas?

Hi DrWorm,

There are two alternatives which may retrieve your files. I would suggest you to use in the order I tell you.
First, there are the e2tools which could search and copy files from an unmounted file system. It's a source package which generates e2ls, e2cp, etc. e2ls is an ls like command and e2cp is a cp like also. So you can traverse the directory of the disk, locate the file and copy to another disk.
If the first option is not enough, the second alternative (which I call it as a suicide option) is to use mke2fs with the option "-S". This option will recreate the superblock but does not touch the inode table. After this you run e2fsck to recover the files from the inode table. Read the mke2fs man page for more explanations. After this operation, some files will be placed on the right path with the right name but some may be moved to /lost+found, loosing its names but preserving its contents and some files may be lost. It's a last resort.

I already used both alternatives, in that order. The problem with the second is that it is the last, the final one.

Very Very good luck to you!

Osvaldo.

Thanks for your help. I'm having some problems. One, when I tried to compile e2tools (on Knoppix), it crashed instantly with syntax errors. Configure worked fine. Any ideas there? Also, mke2fs's man page tells me that I have to specify the block size for it to work. However, I can't remember what the block size is... If I have an 8.4 or so gig partition, what will the block size be? Thanks.

Hi DrWorm,

You need to download and install e2fsprogs to install e2tools as per the readme. E2tools needs ext2 libraries to access the file system. May be this is the reason for the compiler errors. If you still have problems, post the errors for us to interpret them.

Talking about mke2fs syntax, generally we stand by defaults which are enough for normal use. I hope you didn't read this syntax when you installed this system so you didn't change any parameters at that time. As I said before, this is a final solution so, let's try to get e2tools working before that.

Osvaldo.

The readme! Of course! I skimmed it, but I didn't read the whole thing. Really smart... *smacks head against wall* Okay anyway, this is Knoppix so I'll have to either remaster it or create a chroot thing of some sort to install libraries. Awesome. I'll get around to that soon. Thanks again.

Hi DrWorm,

It's time to have a new disk prepared to get the information you are about to recover.

Osvaldo.

I have a 6 gig disk ready, but it is kinda slow. I also have about 10 gig on the same physical hard drive which is free. I'll probably just partition that.

Hi,

I would suggest you to get the 6gig disk. It's important because, if you have some problems with the disk under care, the information will physically out of it.

Osvaldo.

Yeah, that's a good point. Thanks for your help.

I added a forty gig hard drive, so now there's plenty of space. On the first two gigs, I put a basic RedHat install. It has e2fsprogs and e2tools installed as well. I tested e2ls on /dev/hda1 (the RedHat root partition) and it worked fine. But when I tried it on /dev/hdb1 (the /boot partition on the damaged disk), it said "Can't read an inode bitmap" twice and dropped me back to a command prompt. My first thought is that the disk is damaged, but I can get Linux to load an initrd from that partition fine. Also, Knoppix can mount the /usr partition on that disk (e2ls fails with "Invalid argument" when I try to read that partition.) Any ideas? Also, what do you think about using e2salvage?

Hi DrWorm,

Nice to know you're plenty of space now! I would suggest you to reserve another partition to make an alternative root. It would be basically a copy ot the actual root, changing just the /etc/fstab and the initrd. That partition would not be mounted every day but the boot loader should be capable of boot it in cases where the boot fails with fsck. Another reason to it would be upgrades: when installing a new version, that would be installed on the alternative root; if successful, that would be turned the main root and, after the stability tests would be copied to the old root partition. That is easy to implement when we get a new disk but, after being in production, it's almost impossible.

With respect to the rescue of the partitions, based on standards, I would suggest you to concentrate your efforts on the root partition as the boot partition would contain just a kernel image, the initrd and a few more files to boot the system. The root filesystem is where your information resides; the directory /etc has the system configuration and the /home contains the user information and data; if you can retrieve the root and the usr filesystems it's relatively easy to place a new kernel and configure a boot loader to return your system into production.

On my last recovery, on the Christmas eve last year, I didn't use the e2salvage because it was a 15gB partition with customer data and I couldn't use dd to follow their recommendations and I was 500 milles away on vacation. But, if you have important data on the affected filesystem, you could give it a try.

With respect to e2ls, the syntax is a bit tricky; it should beIf it does not work, you may have some compatibility problem with the e2fs library.

I wish you good luck.

Osvaldo.

Compatibility problems make sense, but it can ls the 6Gig partition on my old SCSI disk and all of the ext3 partitions on the new 40Gig disk. Knoppix can still mount fine.