LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices


Reply
  Search this Thread
Old 05-02-2012, 12:02 AM   #1
shachter
Member
 
Registered: Jul 2007
Posts: 101

Rep: Reputation: 2
How do I recover an ext4 filesystem where all the data are intact?


An ext4 filesystem on my USB stick has been trashed in a
peculiar way. All the data are intact, but everything up
to the data has been trashed. Thus, from dd if=/dev/sdb2 | od -bc:
Code:
0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
         \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0
*
17610000 002 000 000 000 014 000 001 002 056 000 000 000 002 000 000 000
        002  \0  \0  \0  \f  \0 001 002   .  \0  \0  \0 002  \0  \0  \0
17610020 014 000 002 002 056 056 000 000 013 000 000 000 024 000 012 002
         \f  \0 002 002   .   .  \0  \0  \v  \0  \0  \0 024  \0  \n 002
17610040 154 157 163 164 053 146 157 165 156 144 000 000 015 000 000 000
          l   o   s   t   +   f   o   u   n   d  \0  \0  \r  \0  \0  \0
You should ascribe no significance to the 17610000 above because part
of the problem is that the partition table has also been trashed; I
don't know exactly where my /dev/sdb2 used to begin. But it is
clear from the above that there are quite a few 0 bytes, up until
the contents of the root directory. Thereafter, it seems that all
the former contents of the filesystem are intact. Assuming that the
root directory is the first object in an ext4 filesystem, it seems
that all the metadata -- i.e., everything prior to the root
directory -- has been trashed, but that the files and directories
themselves are still there.

How do I recover my filesystem? I have considered the possibility
that if I could just get the partitioning right, beginning /dev/sdb2
where it used to begin, then an fsck could repair the filesystem,
but that seems unlikely. But maybe there is backup metadata
scattered throughout the disk, as in the case of an old-fashioned
UFS filesystem, with cylinder groups. So, how then do I figure out
where /dev/sdb2 used to begin? I have done od -bc on other ext4
filesystems, and the root directory is not located at a fixed offset
from the beginning of the device, it's not like the old UFS
filesystems where you knew that the superblock was in block 1 and
that the root directory began in block 2. If there is a way of
determining, from the position of the root directory, where the
device used to begin, please let me know what it is. But that
question is subservient to the main question, which is, how do I
restore my ext4 filesystem to a usable state? There is a huge
amount of data on that USB drive, which is vitally needed, and which
is not yet lost -- it is there on the device, but I can't access it,
without your help. Thank you in advance for any and all replies.

jay at m5 dot chicago dot il dot us
+1 773/7613784 landline
+1 410/9964737 GoogleVoice
 
Old 05-02-2012, 12:07 AM   #2
sag47
Senior Member
 
Registered: Sep 2009
Location: Raleigh, NC
Distribution: Ubuntu, PopOS, Raspbian
Posts: 1,899
Blog Entries: 36

Rep: Reputation: 477Reputation: 477Reputation: 477Reputation: 477Reputation: 477
parted has an option to rescue partitions. I've used it before and it worked out okay for me. Make sure you dd to backup your drive as an image.

After a quick google search here's an ok tutorial though I did it just by using parted help commands originally.
http://ubuntuforums.org/showthread.php?t=370121

Last edited by sag47; 05-02-2012 at 12:08 AM.
 
Old 05-06-2012, 04:50 PM   #3
shachter
Member
 
Registered: Jul 2007
Posts: 101

Original Poster
Rep: Reputation: 2
Alas, neither parted no gpart (the tool referred to in the above link)
is currently aware of ext4, so I could not make use of the above advice.

I repartitioned the device -- this time, noting the beginning and
ending sectors of each slice -- recreated and repopulated an ext4
filesystem on the new slice, and re-subjected the device to the procedure
that had trashed its partition table the first time. When the partition
table was trashed again, I recreated the lost slice in the same position
as before, having taken the above-mentioned precaution of remembering
where it began and ended. But enough of the filesystem metadata has also
been trashed (even though all the file and directory contents appeared to
be intact) that "fsck -t ext4" was unable to save all, or even most, of
the filesystem. It seems to me that if all the file and directory
contents are intact, it should be able to restore the filesystem, but
go argue with fsck.

I shall mark this thread as "solved", not because it is solved, because
it is not, but because I believe that no solution can be forthcoming.
 
Old 05-06-2012, 07:50 PM   #4
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 21,120

Rep: Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120
Try testdisk for the partition(s) recovery.
Try "mkfs.ext4 -S ..." for the filesystem. Note the warnings in the manpage.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
attempting to recover data from damaged ext4 circuit_PT Linux - Server 19 02-25-2012 10:23 PM
Increasing HDD size while keeping data intact WojtekO Linux - Server 1 06-15-2010 09:47 PM
ext3 used as ext4 by mistake.. Any way to recover my data? Please help. DigiH Linux - Desktop 9 11-27-2009 02:27 AM
Can I install RedHat on an existing partition leaving data intact? prcarp Linux - Newbie 1 02-09-2004 08:00 AM
Recover Data in Dead ReiserFS Filesystem Schultz Linux - Newbie 4 10-15-2003 04:18 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - General

All times are GMT -5. The time now is 01:49 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration