-   Linux - Software (
-   -   data recovery of ext3 partition (

awalp 08-02-2007 08:12 PM

data recovery of ext3 partition
I need some assistance on recovering data from some ext3 partitions. I accidently formatted two 250gb /dev/sda partitions with reiserfs, when they were already formatted ext3 and full of data during some routine maintenance work. How can I recovery my 500gb of data?

PatrickNew 08-02-2007 08:17 PM

Whatever you do, do not mount those partitions. It can cause data loss. If all you do is mount, the loss will likely be minimal, but best if you can avoid it. Try looking into a tool called foremost. It scans the raw data on the drive and tries to recognize files.

jay73 08-02-2007 09:30 PM

Photorec tends to work even better than foremost. Just bear in mind that you'll need at least 2x 250GB empty space to save the recovered files to.

awalp 08-03-2007 05:38 AM

I tried out both pieces of software suggested. Foremost seems to be nice in the fact it sorts files into directories by type, and preserves the original name, but it is limited in the files it recovers.

the photorec software seems to be able to recover all my file types, but the problem is it recovers each file by putting a number and extension, nothing more, and 500gb of 123435324.ext, with mostly organized websites in folders isn't really much of a recovery.

I'm looking for a way to preserve the original directory structure and file names with the recovery.

jay73 08-03-2007 05:56 AM

I'm sorry but that won't work. The file names and folder directories are located at the start of a partition - and that's the part that gets wiped during a format so that space is created for a new "table of contents". You will be able to recover the files but their names are lost.

PatrickNew 08-03-2007 02:55 PM

Depending on how important it is, all may not be lost. Immediately remove the drive from a machine and contact a professional. There exists equipment to read overwritten data on a hard drive. But if this is just your home PC, it's not worth the cost. Expect to pay hundreds of dollars, minimum.

awalp 08-04-2007 02:05 AM

by formatting the drive over, I thought it just changed the partition information.

I switched the partition type back to ext2 and tried to recover the partition using alternative superblocks located throughout the drive but ended up with an empty partition.

There must be a way to recovery the data, at least from the other drive that I did not work on yet, 3 seconds of accidental formatting could not of erased 250gb of data.

I need to somehow recreate the ext3 map of the drive.

syg00 08-04-2007 03:31 AM


Originally Posted by awalp
by formatting the drive over, I thought it just changed the partition information.

You thought wrong.

There must be a way to recovery the data, at least from the other drive that I did not work on yet, 3 seconds of accidental formatting could not of erased 250gb of data.

I need to somehow recreate the ext3 map of the drive.
See jay73's post above.

unSpawn 08-04-2007 06:29 AM

Noticing you talk about websites, renaming could be done if the websites where uploaded to a remote location. Then you could 'md5deep' the remote files and compare hashes with locally recovered files. Just an idea.

zzzptg 08-31-2007 08:03 PM


i'm getting the same problem, after the disk pressisted to be always full, even when deleted some folders
I decided to delete all the folders except the /home ......

Well now i cant even mount the disk
and e2fsck gives me a bunch of errors, even using the backup superblocks


[admin@myasus root]$ fsck.ext3 -b 32768 /dev/discs/disc0/part5
e2fsck 1.38 (30-Jun-2005)
Inode table for group 0 is not in group.  (block 1177535144)

e2fsck: e2fsck_read_bitmaps: illegal bitmap block(s) for MyBook

got a 250GB disk full of stuff, dont want to lose it :(

In my search found this sites, may be helpful for somebody

Hack 94. Recover Data from Crashed Disks

LiveCD - (R)ecovery (I)s (P)ossible Linux rescue system

zzzptg 09-01-2007 11:42 AM

i dont even have the lost+found folder :(

i'm still hoping to recover...

What kind of files do you want to recover? Here's my process for general purpose recovery:

1) make an image with dd_rescue
2) run testdisk on the image
3) run foremost on the image
4) run photorec on the image

Photorec and Testdisk are both by the same author. Foremost is a data recovery tool developed by the US Airforce (I think). Typically I'm just recovering jpegs, movies, documents, etc.

AwesomeMachine 09-02-2007 06:36 AM

You can put an ext3 file system back on the two drives, which has a negligible effect on the data, and use fsck.ext3 --rebuild tree /dev/sda. I think the command is a little different than .ext3, but you can look it up, man fsck. Rebuild tree turns all the leaf nodes in the file system back into files, by reading every one of them. I recovered most of a previous installation after I reformatted, and installed linux over an existing installation. Then I remembered I needed something from the old installation, so I used a live cd, and fsck to rebuild everything that wasn't written over. I got the file back, and I just left everything else. It was sweet. Don't worry about mounting. You've really messed up. I don't think a few more lost bytes will hurt you.

zzzptg 09-03-2007 08:28 AM

Using DiskInternals Linux recovery, i'm able to recover many files...
But no file names or directories.

I want to recover mostly avi files, but when it recovers, the files comes broken.
The metadata (resolution, and length of movie) are correct, but when i play anly has 3 seconds black...
Tried VirtualDub, but no chance :(

zzzptg 09-04-2007 03:55 PM

Somebody with the same problem resolved this way:

[root@adrock init.d]# dd if=/dev/ida/c0d0p7 of=/big/var.bak.dd
530368+0 records in

Still hosed, but now I have a backup of the burnination. And now for the FIX!!!

mke2fs -S /dev/ida/c0d0p7
mke2fs 1.27 (8-Mar-2002)
Filesystem label=
OS type: Linux
Block size=1024 (log=0)
Fragment size=1024 (log=0)
66528 inodes, 265184 blocks
13259 blocks (5.00%) reserved for the super user
First data block=1
33 block groups
8192 blocks per group, 8192 fragments per group
2016 inodes per group
Superblock backups stored on blocks:
8193, 24577, 40961, 57345, 73729, 204801, 221185

Writing superblocks and filesystem accounting information: done

That did it! mke2fs re-wrote all of the superblocks and group descriptors and I was able to mount in RO mode and copy off the data. After that I was able to fsck and remount the original parition with no problems!

other case:

zzzptg 09-04-2007 05:07 PM



Solution (make backups if you can :p)
mke2fs -S /dev/ida/c0d0p7

fsck ...


bahh :scratch:
it seems to only recovered some files ....
i can see all the folders but some of them are unredable

i though ive recovered, all the files, but it seems that only 23GB of the 250GB are visible
will backup the recovered data, and them I will run again fsck to see if fixes more problems..

All times are GMT -5. The time now is 12:35 PM.