[opensuse] How to Recover a folder structure from an Ext4 partition that was repaired with fsck
Hello Looking for help on this (): I've got a PC with a 320GB hdd. And this is the partition structure: sda1 - - - /boot - - - (200 MB) - - - Ext4 sda2 - - - swap - - (8 GB) - - - - - Swap sda3 - - - / - - - - - - (20 GB) - - - - Ext4 sda4 - - - /home - - - (270 GB) - - - Ext4 The HOME partition was corrupted. Then I plug the disk in another PC, via USB adapter, and ran: fsck -t ext4 -fy /dev/sdb4 The partition was successfully mounted and all the files were recovered, but they appear in numbered folders, under <lost+found> folder. --> Now my question: Is there any way I could recover the original folder structure? (there are plenty of files, and it is a huge task to re-catalog them in a new structure) Thanks in advance Kyma -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
On Wed, Jul 18, 2012 at 10:50 AM, Kym <kymacoll@gmail.com> wrote:
Hello
Looking for help on this ():
I've got a PC with a 320GB hdd. And this is the partition structure:
sda1 - - - /boot - - - (200 MB) - - - Ext4 sda2 - - - swap - - (8 GB) - - - - - Swap sda3 - - - / - - - - - - (20 GB) - - - - Ext4 sda4 - - - /home - - - (270 GB) - - - Ext4
The HOME partition was corrupted. Then I plug the disk in another PC, via USB adapter, and ran:
fsck -t ext4 -fy /dev/sdb4
The partition was successfully mounted and all the files were recovered, but they appear in numbered folders, under <lost+found> folder.
--> Now my question: Is there any way I could recover the original folder structure? (there are plenty of files, and it is a huge task to re-catalog them in a new structure)
Thanks in advance Kyma
I doubt it will help, but you could try ext4magic. http://software.opensuse.org/package/ext4magic?search_term=ext4magic If you speak German, the main site is: http://openfacts2.berlios.de/wikide/index.php/BerliosProject:Ext4magic I think there is an english version of that page, but I don't know the url and I don't speak German, so I can't tell you what it says. If it learn anything about how ext4magic works, please create a opensuse wiki page for it and I'll add a link to it from the Digital Forensics portal: http://en.opensuse.org/Portal:Digital_Forensics_/_Incident_Response Thanks Greg -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wednesday, 2012-07-18 at 10:50 -0400, Kym wrote:
fsck -t ext4 -fy /dev/sdb4
The partition was successfully mounted and all the files were recovered, but they appear in numbered folders, under <lost+found> folder.
It is curious how this happens on very different filesystem types, when damaged badly. Last time I saw that was on an NTFS partition (MFT damaged). Photorec recovered most of the files, but all directories where converted to numbers. In the end, I had to use proprietary software (Restorer Ultimate), which I saw recomended at the photorec site, of all places. I remember that in MsDos times we had utilities that did backups of the directory structure in files placed strategically on the disks. Perhaps we should do the same now :-? - -- Cheers, Carlos E. R. (from 11.4 x86_64 "Celadon" at Telcontar) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.16 (GNU/Linux) iEYEARECAAYFAlAIepIACgkQtTMYHG2NR9ULEwCfW52KYpp8fkZTEQlF9U7SyaKL K0MAoIz2LbKOebtMzjj0zgODSNrxNtL/ =0LAU -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
On Thu, 19 Jul 2012 23:22:26 +0200 (CEST) "Carlos E. R." <robin.listas@telefonica.net> wrote:
I remember that in MsDos times we had utilities that did backups of the directory structure in files placed strategically on the disks. Perhaps we should do the same now :-?
e2image will create image of superblock, block group descriptor, block and inode allocation bitmaps, and the inode table that can be stored elsewhere. File system itself will store superblock every 8k blocks, so it is not that easy to break it as DOS with 2 FAT tables. -- Regards, Rajko -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 2012-07-21 03:43, Rajko wrote:
On Thu, 19 Jul 2012 23:22:26 +0200 (CEST) "Carlos E. R." <> wrote:
I remember that in MsDos times we had utilities that did backups of the directory structure in files placed strategically on the disks. Perhaps we should do the same now :-?
e2image will create image of superblock, block group descriptor, block and inode allocation bitmaps, and the inode table that can be stored elsewhere.
But e2fsck can not use it - so says the man page.
File system itself will store superblock every 8k blocks, so it is not that easy to break it as DOS with 2 FAT tables.
Yes, but what is lost are the directory names of all directories, or all rootlevel directories. That's what I have seen destroyed completely on several filesystems. - -- Cheers / Saludos, Carlos E. R. (from 11.4 x86_64 "Celadon" at Telcontar) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.16 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAlAKnLMACgkQIvFNjefEBxpyhwCfaeQbUpm+RXJfs12BHaeaMN0n lAIAnjQDicarPNWjqMWndxVkSCy+rXMO =VO6N -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
Hello, On Fri, 20 Jul 2012, Rajko wrote: [ext2/3/4]
File system itself will store superblock every 8k blocks, so it is not that easy to break it as DOS with 2 FAT tables.
By default. I use "sparse_super", which corresponds to fewer copies (e.g. every 32k blocks). -dnh -- "Now, what was I doing before I so rudely interrupted myself?" -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
participants (5)
-
Carlos E. R. -
David Haller -
Greg Freemyer -
Kym -
Rajko