Manual file system fixing with e2fsck -- are my files permanently lost?
Linux - SoftwareThis forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
Manual file system fixing with e2fsck -- are my files permanently lost?
So my Fedora Core 6 ext3 /home partition somehow got its superblock corrupted. I looked around a bit for common fixes and they don't work. This includes manually passing a backup superblock number to e2fsck. It only demands that you manually go through and make a decision on every little error it finds.
So, am I screwed? I'm not really sure what e2fsck is doing during the manual repair process. I let it overwrite some "broken" sectors. Then in the next repair stage, it named certain files that it wanted to clear. So I tried a few, and indeed, those files and directories were replaced by empty files. However many of the other files on this partition are still available.
I've been working on it using my Fedora Rescue CD. How should I go about fixing this problem? Of course I can just go and reformat the /home partition and/or reinstall the OS, but I'd rather not go to that extreme. Any better ideas, or comforting pointers? I've never had to mess with e2fsck manually before.
When it asks for your input usually means there is a un-recoverable problem. You can recover all data with a live CD from the /home partition using "photorec" (typed in a terminal), then re-install to save a couple weeks, and a couple years of your life expectancy by avoiding the stress.
Last edited by Junior Hacker; 04-02-2007 at 08:33 PM.
Thanks for the pointer to photorec -- I had never heard of it, but it looks like a great tool (and included with Knoppix!) However I couldn't use it because I had files of many unsupported formats to try and save (my whole /home directory).
It was a filesystem problem. I don't know what happened, but apparently some of the blocks were inaccessible. e2fsck forced a manual check, and I let it go through and automatically answer 'yes' to every question so it rewrote the bad blocks.
Fortunately I was able to backup almost all of my files beforehand by using the Knoppix live cd and copying the relevant partition to a remote host with rsync. I wound up losing a few files, perhaps due to my first muddling attempt at fixing the problem, before I backed up.
And yes, photorec ( and also foremost, but i have found this less good at least with jpeg ) is a great tool.
A couple weeks ago, I repaired a customer's computer, I chose to "move" their data back on their repaired system from my external drive instead of using my usual protocol, which is to "copy" it back and delete their data after delivering the unit and advising they back up. Something went wrong during the transfer and I deleted the partially filled folder from their computer, then went to try again only to find most of the data was gone off my drive because of the stupid move.
I used foremost 1.1 & 1.4 from source in different OS's, I used foremost 1.3 from repos in Debian Etch, and foremost 1.2 off the Helix Live CD, photorec off the Helix CD, and the latest scalpel from source in another older OS.
The foremost 1.3 from Debian repositories in Etch got the best results with 285 full size, and all thumbnails of the approximately 400 photos from their digital camera. The foremost 1.1 from source got all the thumbnails but only about 260 full size. The foremost 1.2 on the Helix CD only got the thumbnails (not sure which jpg line in foremost.conf I used though). The foremost 1.4 from source only got the full size, same with Photorec. Scalpel which is a re-vamp of foremost, only got about half the thumbnails.
Foremost has 3 to 4 different types of header/footer styles to use in the configuration file, the last one with no junk in between the header and footer produces the most. Of the 10GB dd image of the section of this FAT32 drive that had the photos, I usually got around 5GB of .jpg files with foremost, most were not readable, photorec would produce a text file representing these un readable .jpgs foremost produced.
I have a feeling the thumbnails are from the directory/folder they were in, and because I pulled another stupid move by adding 8GB of data to the drive before finding these tools, I may have overwritten some of the sectors of the last 115 or so full size. But because I got different results from different tools, I'm going to dig deeper with sleuthkit and hex editors (I envision smoke coming out of my ears), as I've read that some data may not be recovered by data carvers on fragmented drives. And this drive has not been de-fragmented, and is my backup drive which gets files written and deleted often.
Maybe I'll learn something digging deeper, maybe I'll burn something out.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.