Mailinglist Archive: opensuse (1420 mails)

< Previous Next >
Re: [opensuse] Re: Restore filesystem without losing data?
  • From: Greg Freemyer <greg.freemyer@xxxxxxxxx>
  • Date: Thu, 30 Jan 2014 13:12:16 -0500
  • Message-id: <CAGpXXZKnWsXas2PvoRuTowAc_8Zd06uRHC6he6-kkL2YiHp=pw@mail.gmail.com>
On Thu, Jan 30, 2014 at 11:19 AM, Stephen Berman <stephen.berman@xxxxxxx> wrote:
On Tue, 28 Jan 2014 23:31:42 -0500 Greg Freemyer <greg.freemyer@xxxxxxxxx>
wrote:

Stephen Berman <stephen.berman@xxxxxxx> wrote:

An external hard disk of mine became corrupted, and in an effort to
save
the data on it I dd'd it to another hard disk. Both disks were
formatted in Yast (openSUSE 13.1) with a single ext4 partition. But
after using dd, now the filesystem is gone from the second disk, though
otherwise the partition table appears to be intact, and cat and grep
show at least some of the data. I had run `e2fsck -b 32768 -c' on the
first disk when the problem first appeared (it was unmountable), but
that seemed to make things worse, so I'm reluctant to try it on the
second disk, unless someone convinces me I used it wrong and tells me
the right way. Or is there another way to restore the filesystem
without losing the data?

Steve Berman

Most if not all of the recommendations were disk recovery tools or file
carvers.

Both have their use, but your disk seems fine and file carving is a last
resort.

Why is that?

A file carver, such as foremost, testdisk, photrec works by scanning
all sectors looking for recognizable file headers.

Once they find that, they do a linear scan of the drive in an effort
to find the end of the file. In many cases, they just guess.

Note, that because they are not looking a filesystem metadata at all,
they have these major shortcomings:

- They never recover the filename since that is maintained in the
directory metadata, not in the file itself

- They make no effort to recover the path information

- They make no effort to recover fragmented files

- They can only recover files that have well-defined header signatures
and which have a well defined way to know where the end of the file
is.

Now, if the corrupted disk is full of photos from a camera, the above
limitations may not be a problem. Lots of files are actually not
fragmented and for cameras the path and filename info isn't all that
important in the first place. Further JPEGs have a well defined
header and you can determine how long file is from context inside the
JPEG. That's why so many people have absolutely great success
recovering photo's from camera media via photorec.

Your case doesn't seem to one that would work well with a data carver.

The best option for your case is a scanner that understands ext4
directory/inside style metadata and uses it to pull out files with accurate
names and even paths.

I've got commercial software that does that. The only open source app for
that I know is ext4magic

http://software.opensuse.org/search?q=ext4magic

I packaged it, but I only did minimal testing. I don't know why someone else
packaged the older version, but you can try it out too.

As far as I understood from the man page, this is for recovering deleted
files from an intact ext4 filesystem. But my case is the opposite: the
data is there, but the filesystem is gone (or anyway unrecognizable).

From the projects home page
<http://openfacts2.berlios.de/wikien/index.php/BerliosProject:Ext4magic>
summary section

"includes functions tries to recover a partially destroyed file system."

I can only assume that is what you have (ie. a partially destroyed file system).

fyi: If you speak German, the author of ext4magic recommends
<http://openfacts2.berlios.de/wikide/index.php/BerliosProject:Ext4magic>
as having more documentation than the english version.

In any case, as far as I could tell both ext4magic and foremost (the
file carving tool also recommended) work essentially on an all or
nothing basis. Both the corrupted disk and the good disk that I dd'd
the data to are 3TB external disks, and I don't have that much space on
my other disks, so until I replace the corrupted disk I can't try to
recover all the data in one go.

The dd copy you made seemed to complete with no errors. That's great,
but now you effectively have 2 identical copies of the corrupted
filesystem.

You either need to invest some money and buy a 3rd 3TB drive, or
re-format the drive with the second copy you made and use the drive to
hold the output of ext4magic and/or foremost run against the original
drive.

So the question at hand relates to the value of the data on the drive.
It is valuable, I would buy a 3rd drive. If it is nice to have, then
trash the second copy and proceed with trying to pull good data out of
the original.

The one thing you don't want to do is write to the original. Don't
even try to mount it. Tools like ext4magic and foremost are designed
to work with the ram filesystem, not with a mounted version of it.

Steve Berman

Greg
--
To unsubscribe, e-mail: opensuse+unsubscribe@xxxxxxxxxxxx
To contact the owner, e-mail: opensuse+owner@xxxxxxxxxxxx

< Previous Next >