Menu

#3 ext4magic error-NR 22 can not found file: /

open
Robi
None
2015-10-19
2015-09-23
Simos
No

Hi,

I'm trying to use ext4magic on a Debian 8.2 system where I accidentally deleted some files due to an rsync misconfiguration. The ext4 filesystem is normally mounted on /data and is on md array /dev/md3. I unmounted /data shortly after I realized my mistake but almost all ext4magic operations give me the same error "NR 22", for example:

# ext4magic /dev/md3 -l
Filesystem in use: /dev/md3

Using  internal Journal at Inode 8
Inode 2 is allocated
Warning: error-NR 22 can not found file: /
ext4magic : EXIT_SUCCESS

I can use ext4magic to print the superblock, journal, etc. but cannot list or recover any files. I was able to recover some of the files with extundelete but I need to get at least listing of the directories and possibly the files I deleted.

The version of ext4magic in Debian stable is 0.3.2-2.

I can provide any additional information needed to troubleshoot this error. I looked in the source code for this error message but it was impossible for me to follow.

Thanks & Regards,

Simos

Discussion

  • Robi

    Robi - 2015-09-27

    Hi,

    The error states ext4magic can not find the root directory. The error number indicates error when reading or interpret a block. It is unclear whether it is the inode block, or the block in which are store the directory data. Also unclear is whether this block comes from the Jornal or not. Thus, the error does not clearly identify only from this error number.

    You can try: The output of all inode number 2 from the Journal.
    ext4magic -T -x -I2 /dev/md3

    This will display the inode data of the root directory may exist in the journal, and the corresponding directory data that are in the current directory data block. If the current directory data block defective or can not interpreted from ext4magic, then you get there no output directory. In this case, it may perhaps be helpful to locate also a copy of that block in the journal.
    You need the blocknummer, output example

    Dump Inode 2 from journal transaction 738482
    Inode: 2 Type: directory Mode: 0755 Flags: 0x80000
    Generation: 0 Version: 0x00000000:00000867
    User: 0 Group: 0 Size: 4096
    File ACL: 0 Directory ACL: 0
    Links: 31 Blockcount: 8
    Fragment: Address: 0 Number: 0 Size: 0
    ctime: 1443309086:3841393952 -- Sun Sep 27 01:11:26 2015
    atime: 1443308983:3121476516 -- Sun Sep 27 01:09:43 2015
    mtime: 1443309086:3841393952 -- Sun Sep 27 01:11:26 2015
    crtime: 1356652343:0000000000 -- Fri Dec 28 00:52:23 2012
    Size of extra inode fields: 28
    Level Entries Logical Physical Length Flags
    0/ 0 1/ 1 0 - 0 9265 - 9265 1
    2 d 755 (2) 0 0 4096 10-Sep-2015 21:07 .
    2 d 755 (2) 0 0 4096 10-Sep-2015 21:07 ..
    11 d 700 (2) 0 0 16384 28-Dec-2012 00:52 lost+found
    787969 d 755 (2) 0 0 12288 27-Sep-2015 01:10 etc
    919297 d 755 (2) 0 0 4096 28-Dec-2012 00:52 home
    ......

    The line
    0/ 0 1/ 1 0 - 0 9265 - 9265 1
    indicates the data blocks (the directory data) for this inode. In this case, only a single block Nr. 9265
    You can also try to find copies of that block in the journal

    ext4magic -T -B 9265 /dev/md3

    If you found some old inode data for the root directory, then look to the timestamps and the transaction number.
    Then you can try to list or recover with the corresponding time period ( -a ... -b ...) or with the correct Transaction Number ( -t ...) See also the man page.
    Example :
    ext4magic -l -I2 -t 738..... /dev/md3

    Good luck

    regards Robi

     
  • Simos

    Simos - 2015-10-13

    Hello Robi,

    Thank you very much for your detailed reply. Over the last couple of weeks I've tried your suggestions in different ways but with no luck. You can see the output of the commands below (I still get "error-NR 22" when I try to list by transaction).

    I would appreciate your comments if you can see anything obvious about what I'm doing wrong or I should be doing differently, otherwise I'll just give up and remount the filesystem and get on with my life! :-)

    Thanks again & regards,

    Simos

    # ext4magic -T -x -I2 /dev/md3
    Filesystem in use: /dev/md3
    
    Using  internal Journal at Inode 8
    Inode 2 is at group 0, block 1057, offset 256
    
    Transactions of Filesystemblock 1057 in Journal
    FS-Block         Journal        Transact        Time in sec     Time of Transaction
            1057         139           30329        1442633070      Fri Sep 18 21:24:30 2015
            1057       19618           26756        1437958957      Sun Jul 26 19:02:37 2015
    
    Dump Inode 2 from journal transaction 26756
    Inode: 2   Type: directory    Mode:  0755   Flags: 0x80000 
    Generation: 0    Version: 0x00000000:00000008
    User:     0   Group:     0   Size: 4096
    File ACL: 0    Directory ACL: 0
    Links: 11   Blockcount: 8
    Fragment:  Address: 0    Number: 0    Size: 0
     ctime: 1437804402:1001424320 -- Sat Jul 25 00:06:42 2015
     atime: 1437940624:1306549488 -- Sun Jul 26 13:57:04 2015
     mtime: 1437804402:1001424320 -- Sat Jul 25 00:06:42 2015
    crtime: 1435433535:0000000000 -- Sat Jun 27 13:32:15 2015
    Size of extra inode fields: 28
    Level Entries                   Logical                  Physical Length Flags
     0/ 0   1/  1           0 -       15615 59466431787265 - 59466431802880  15616 
    
    Dump Inode 2 from journal transaction 30329
    Inode: 2   Type: directory    Mode:  0755   Flags: 0x80000 
    Generation: 0    Version: 0x00000000:00000009
    User:     0   Group:     0   Size: 4096
    File ACL: 0    Directory ACL: 0
    Links: 12   Blockcount: 8
    Fragment:  Address: 0    Number: 0    Size: 0
     ctime: 1438237624:3483354784 -- Thu Jul 30 00:27:04 2015
     atime: 1442633070:1276805960 -- Fri Sep 18 21:24:30 2015
     mtime: 1438237624:3483354784 -- Thu Jul 30 00:27:04 2015
    crtime: 1435433535:0000000000 -- Sat Jun 27 13:32:15 2015
    Size of extra inode fields: 28
    Level Entries                   Logical                  Physical Length Flags
     0/ 0   1/  1           0 -       15615 59466431787265 - 59466431802880  15616 
    
    Dump Inode 2 from journal transaction 0
    Inode: 2   Type: directory    Mode:  0755   Flags: 0x80000 
    Generation: 0    Version: 0x00000000:00000009
    User:     0   Group:     0   Size: 4096
    File ACL: 0    Directory ACL: 0
    Links: 12   Blockcount: 8
    Fragment:  Address: 0    Number: 0    Size: 0
     ctime: 1438237624:3483354784 -- Thu Jul 30 00:27:04 2015
     atime: 1442633070:1276805960 -- Fri Sep 18 21:24:30 2015
     mtime: 1438237624:3483354784 -- Thu Jul 30 00:27:04 2015
    crtime: 1435433535:0000000000 -- Sat Jun 27 13:32:15 2015
    Size of extra inode fields: 28
    Level Entries                   Logical                  Physical Length Flags
     0/ 0   1/  1           0 -       15615 59466431787265 - 59466431802880  15616 
    
    ext4magic : EXIT_SUCCESS
    
    # ext4magic -l -I2 -t 26756  /dev/md3
    Filesystem in use: /dev/md3
    
    Using  internal Journal at Inode 8
    
    Dump Inode 2 from journal transaction 26756
    Inode: 2   Type: directory    Mode:  0755   Flags: 0x80000 
    Generation: 0    Version: 0x00000000:00000008
    User:     0   Group:     0   Size: 4096
    File ACL: 0    Directory ACL: 0
    Links: 11   Blockcount: 8
    Fragment:  Address: 0    Number: 0    Size: 0
     ctime: 1437804402:1001424320 -- Sat Jul 25 00:06:42 2015
     atime: 1437940624:1306549488 -- Sun Jul 26 13:57:04 2015
     mtime: 1437804402:1001424320 -- Sat Jul 25 00:06:42 2015
    crtime: 1435433535:0000000000 -- Sat Jun 27 13:32:15 2015
    Size of extra inode fields: 28
    Inode 2 is allocated
    Warning: error-NR 22 can not found file: /
    ext4magic : EXIT_SUCCESS
    
    # ext4magic -l -I2 -t 30329  /dev/md3
    Filesystem in use: /dev/md3
    
    Using  internal Journal at Inode 8
    
    Dump Inode 2 from journal transaction 30329
    Inode: 2   Type: directory    Mode:  0755   Flags: 0x80000 
    Generation: 0    Version: 0x00000000:00000009
    User:     0   Group:     0   Size: 4096
    File ACL: 0    Directory ACL: 0
    Links: 12   Blockcount: 8
    Fragment:  Address: 0    Number: 0    Size: 0
     ctime: 1438237624:3483354784 -- Thu Jul 30 00:27:04 2015
     atime: 1442633070:1276805960 -- Fri Sep 18 21:24:30 2015
     mtime: 1438237624:3483354784 -- Thu Jul 30 00:27:04 2015
    crtime: 1435433535:0000000000 -- Sat Jun 27 13:32:15 2015
    Size of extra inode fields: 28
    Inode 2 is allocated
    Warning: error-NR 22 can not found file: /
    ext4magic : EXIT_SUCCESS
    
    # ext4magic -T -B 59466431787265 /dev/md3
    Filesystem in use: /dev/md3
    
    Using  internal Journal at Inode 8
    
    Transactions of Filesystemblock 2609574145 in Journal
    FS-Block         Journal        Transact
    ext4magic : EXIT_SUCCESS
    
    # ext4magic -T -B 59466431787266 /dev/md3
    Filesystem in use: /dev/md3
    
    Using  internal Journal at Inode 8
    
    Transactions of Filesystemblock 2609574146 in Journal
    FS-Block         Journal        Transact
    ext4magic : EXIT_SUCCESS
    
    # ext4magic -T -B 59466431787276 /dev/md3
    Filesystem in use: /dev/md3
    
    Using  internal Journal at Inode 8
    
    Transactions of Filesystemblock 2609574156 in Journal
    FS-Block         Journal        Transact
    ext4magic : EXIT_SUCCESS
    
     

    Last edit: Simos 2015-10-14
  • Simos

    Simos - 2015-10-13

    Hi again,

    I played around with ext4magic some more last night and was able to simply use the -I flag to print the contents of the root inode (ext4magic -I 2 /dev/md3), followed the inode numbers down to the directory that I destroyed, and was able to get a list of the "top-level" sub-directories and files I deleted, which helps a lot in trying to reconstruct what was there. Thanks again for putting this tool together!

    Regards,

    Simos

     
  • Robi

    Robi - 2015-10-14

    Hi Simos,

    I hope you can now recover the lost files.

    But in your output of inode data I have seen something that looks like a bug.
    "Level Entries Logical Physical Length Flags
    0/ 0 1/ 1 0 - 15615 59466431787265 - 59466431802880 15616"
    is absolute nonsense and impossible. This is a 48-bit display of a 32-bit variable.

    You can help me to try to reproduce and analyze this.

    I need your kernel version and your architecture. (uname -a) and the exact name of your glibc package.
    (example : libc6_2.19-18+deb8u1_amd64.deb)

    May also be helpful, the raw output of this inode.
    ext4magic -B 1057 /dev/md3 | sed -n '/0100:/,/0200:/p'

    and the file system header
    ext4magic -S /dev/md3

    Regards,

    Robi

     
  • Simos

    Simos - 2015-10-15

    Hi Robi,

    Here you go, hope it helps. Let me know if you need more, I haven't remounted the filesystem yet.

    Regards,

    Simos

    $ cat /etc/debian_version 
    8.2
    
    $ uname -a
    Linux cedric 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt11-1+deb8u3 (2015-08-04) x86_64 GNU/Linux
    
    $ dpkg -l ext4magic
    ii  ext4magic             0.3.2-2         amd64           recover deleted files from ext3 or ext4 partitio
    
    $ dpkg -l libc6
    ii  libc6:amd64           2.19-18+deb8u1  amd64           GNU C Library: Shared libraries
    
    $ ls /var/cache/apt/archives/libc6_*.deb 
    /var/cache/apt/archives/libc6_2.19-18+deb8u1_amd64.deb
    
    # ext4magic -B 1057 /dev/md3 | sed -n '/0100:/,/0200:/p'
        0100:  ed 41 00 00 00 10 00 00 6e d5 fc 55 b8 c3 b9 55    .A......n..U...U
        0110:  b8 c3 b9 55 00 00 00 00 00 00 0c 00 08 00 00 00    ...U............
        0120:  00 00 08 00 09 00 00 00 0a f3 01 00 04 00 00 00    ................
        0130:  00 00 00 00 00 00 00 00 01 00 00 00 21 24 00 00    ............!$..
        0140:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
        0150:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
        0160:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
        0170:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
        0180:  1c 00 00 00 a0 c6 9f cf a0 c6 9f cf 48 83 1a 4c    ............H..L
        0190:  3f fa 8e 55 00 00 00 00 00 00 00 00 00 00 00 00    ?..U............
        01a0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
        01b0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
        01c0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
        01d0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
        01e0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
        01f0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
        0200:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
    
    # ext4magic -S /dev/md3
    Filesystem in use: /dev/md3
    
    Filesystem volume name:   data
    Last mounted on:          /data
    Filesystem UUID:          58f5af78-738d-4808-bc57-4577e655ad8e
    Filesystem magic number:  0xEF53
    Filesystem revision #:    1 (dynamic)
    Filesystem features:      has_journal ext_attr resize_inode dir_index filetype extent flex_bg sparse_super large_file huge_file uninit_bg dir_nlink extra_isize
    Filesystem flags:         signed_directory_hash 
    Default mount options:    user_xattr acl
    Filesystem state:         clean
    Errors behavior:          Continue
    Filesystem OS type:       Linux
    Inode count:              175472640
    Block count:              701862768
    Reserved block count:     35093138
    Free blocks:              440213587
    Free inodes:              175380642
    First block:              0
    Block size:               4096
    Fragment size:            4096
    Reserved GDT blocks:      856
    Blocks per group:         32768
    Fragments per group:      32768
    Inodes per group:         8192
    Inode blocks per group:   512
    Flex block group size:    16
    Filesystem created:       Sat Jun 27 13:32:15 2015
    Last mount time:          Fri Sep 18 20:11:00 2015
    Last write time:          Fri Sep 18 22:21:07 2015
    Mount count:              43
    Maximum mount count:      -1
    Last checked:             Sat Jun 27 13:32:15 2015
    Check interval:           0 (<none>)
    Lifetime writes:          1607 GB
    Reserved blocks uid:      0 (user root)
    Reserved blocks gid:      0 (group root)
    First inode:              11
    Inode size:               256
    Required extra isize:     28
    Desired extra isize:      28
    Journal inode:            8
    Default directory hash:   half_md4
    Directory Hash Seed:      7eae4d21-867f-4aff-a079-1f22afc9e9e7
    Journal backup:           inode blocks
    ext4magic : EXIT_SUCCESS
    
     
  • Robi

    Robi - 2015-10-15

    Hi Simos,

    the error is 100% reproducible. Also your error message. ext4magic is therefore completely useless in Debian 8.2 (amd64). Which other versions, architecture and distributions are also affected is unknown.

    currently I can not find anywhere an open bug report for this topic. Unbelievable that no one has this yet noticed.

    Thank you once for error report. I will analyze that and hope as soon as possible to find a solution.

    robi

     

Log in to post a comment.

Want the latest updates on software, tech news, and AI?
Get latest updates about software, tech news, and AI from SourceForge directly in your inbox once a month.