On Thu, Jan 30, 2014 at 11:19 AM, Stephen Berman
On Tue, 28 Jan 2014 23:31:42 -0500 Greg Freemyer
wrote: Stephen Berman
wrote: An external hard disk of mine became corrupted, and in an effort to save the data on it I dd'd it to another hard disk. Both disks were formatted in Yast (openSUSE 13.1) with a single ext4 partition. But after using dd, now the filesystem is gone from the second disk, though otherwise the partition table appears to be intact, and cat and grep show at least some of the data. I had run `e2fsck -b 32768 -c' on the first disk when the problem first appeared (it was unmountable), but that seemed to make things worse, so I'm reluctant to try it on the second disk, unless someone convinces me I used it wrong and tells me the right way. Or is there another way to restore the filesystem without losing the data?
Steve Berman
Most if not all of the recommendations were disk recovery tools or file carvers.
Both have their use, but your disk seems fine and file carving is a last resort.
Why is that?
A file carver, such as foremost, testdisk, photrec works by scanning all sectors looking for recognizable file headers. Once they find that, they do a linear scan of the drive in an effort to find the end of the file. In many cases, they just guess. Note, that because they are not looking a filesystem metadata at all, they have these major shortcomings: - They never recover the filename since that is maintained in the directory metadata, not in the file itself - They make no effort to recover the path information - They make no effort to recover fragmented files - They can only recover files that have well-defined header signatures and which have a well defined way to know where the end of the file is. Now, if the corrupted disk is full of photos from a camera, the above limitations may not be a problem. Lots of files are actually not fragmented and for cameras the path and filename info isn't all that important in the first place. Further JPEGs have a well defined header and you can determine how long file is from context inside the JPEG. That's why so many people have absolutely great success recovering photo's from camera media via photorec. Your case doesn't seem to one that would work well with a data carver.
The best option for your case is a scanner that understands ext4 directory/inside style metadata and uses it to pull out files with accurate names and even paths.
I've got commercial software that does that. The only open source app for that I know is ext4magic
http://software.opensuse.org/search?q=ext4magic
I packaged it, but I only did minimal testing. I don't know why someone else packaged the older version, but you can try it out too.
As far as I understood from the man page, this is for recovering deleted files from an intact ext4 filesystem. But my case is the opposite: the data is there, but the filesystem is gone (or anyway unrecognizable).
From the projects home page http://openfacts2.berlios.de/wikien/index.php/BerliosProject:Ext4magic summary section
"includes functions tries to recover a partially destroyed file system." I can only assume that is what you have (ie. a partially destroyed file system). fyi: If you speak German, the author of ext4magic recommends http://openfacts2.berlios.de/wikide/index.php/BerliosProject:Ext4magic as having more documentation than the english version.
In any case, as far as I could tell both ext4magic and foremost (the file carving tool also recommended) work essentially on an all or nothing basis. Both the corrupted disk and the good disk that I dd'd the data to are 3TB external disks, and I don't have that much space on my other disks, so until I replace the corrupted disk I can't try to recover all the data in one go.
The dd copy you made seemed to complete with no errors. That's great, but now you effectively have 2 identical copies of the corrupted filesystem. You either need to invest some money and buy a 3rd 3TB drive, or re-format the drive with the second copy you made and use the drive to hold the output of ext4magic and/or foremost run against the original drive. So the question at hand relates to the value of the data on the drive. It is valuable, I would buy a 3rd drive. If it is nice to have, then trash the second copy and proceed with trying to pull good data out of the original. The one thing you don't want to do is write to the original. Don't even try to mount it. Tools like ext4magic and foremost are designed to work with the ram filesystem, not with a mounted version of it.
Steve Berman
Greg -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org