Thread: [Extundelete-users] Corrupted EXT{3,4} Filesystems
Status: Beta
Brought to you by:
necase
From: <ext...@li...> - 2013-06-10 15:28:28
|
Hello, I'm have a situation where I have a number of EXT partitions that are corrupted and need to recover some files from them. The files I need are likely not deleted, but by ill fate, something like the following happened: dd if=/dev/zero of=/dev/hda bs=1 count=1G So the first gig or so of the underlying device was overwritten. I haven't yet seen a way to use your tools to address this situation, but I may have missed something. Do you have any suggestions, beyond just using traditional carving tools? tim |
From: <ext...@li...> - 2013-06-10 18:18:28
|
> I'm have a situation where I have a number of EXT partitions that are > corrupted and need to recover some files from them. The files I need > are likely not deleted, but by ill fate, something like the following > happened: > > dd if=/dev/zero of=/dev/hda bs=1 count=1G > > > So the first gig or so of the underlying device was overwritten. I > haven't yet seen a way to use your tools to address this situation, > but I may have missed something. Do you have any suggestions, beyond > just using traditional carving tools? > > tim Hi tim, First of all, as far as I know there is no method to recover any data overwritten by dd (unless there is a copy of it somewhere else). extundelete assumes that the partition it is working on is not corrupted, so it is probably not the right tool to recover these files. The best way to try to recover here probably involves using fsck on a copy of the partition to try to repair the corruption and then your files might just be there, though you would have to be careful that parts of them weren't overwritten by zeros. I think even if fsck doesn't repair the corruption automatically, you might be able to manually repair it, but look to the linux-ext4 list on help with that. I've had bad experience with file carving, so I tend to recommend that only after other options have failed. Nic |
From: <ext...@li...> - 2013-06-10 19:10:07
|
Hi Nic, Thanks for the quick reply and your suggestions. I haven't tried it yet, but I suspect fsck isn't going to get me far. I'll need to repair the partition table first as well. My hope was that perhaps there was at tool that can identify EXT inodes independent of the superblock and other structures, and then just follow the series of pointers down to blocks to recover files that way. It seems like inodes and directory structures would probably have a fairly distinct signature that could be used as the starting point. Since the files aren't deleted, the pointers to blocks would be intact with no need to reference the journal. Perhaps ext4magic handles this situation. I'll look into it. thanks, tim On Mon, Jun 10, 2013 at 11:18:21AM -0700, ext...@li... wrote: > > I'm have a situation where I have a number of EXT partitions that are > > corrupted and need to recover some files from them. The files I need > > are likely not deleted, but by ill fate, something like the following > > happened: > > > > dd if=/dev/zero of=/dev/hda bs=1 count=1G > > > > > > So the first gig or so of the underlying device was overwritten. I > > haven't yet seen a way to use your tools to address this situation, > > but I may have missed something. Do you have any suggestions, beyond > > just using traditional carving tools? > > > > tim > > Hi tim, > > First of all, as far as I know there is no method to recover any > data overwritten by dd (unless there is a copy of it somewhere else). > extundelete assumes that the partition it is working on is not > corrupted, so it is probably not the right tool to recover these > files. The best way to try to recover here probably involves using > fsck on a copy of the partition to try to repair the corruption and > then your files might just be there, though you would have to be > careful that parts of them weren't overwritten by zeros. I think > even if fsck doesn't repair the corruption automatically, you might be > able to manually repair it, but look to the linux-ext4 list on help > with that. I've had bad experience with file carving, so I tend to > recommend that only after other options have failed. |
From: <ext...@li...> - 2013-06-10 19:46:03
|
On 10/06/2013 21:55, ext...@li... wrote: > inodes independent of the superblock and other structures, and then > just follow the series of pointers down to blocks to recover files > that way. It seems like inodes and directory structures would > probably have a fairly distinct signature that could be used as the > starting point. Since the files aren't deleted, the pointers to I think there should be many copies of superblock, one at the end of a modern file system. I'm wrong? Valerio |