linux-ext4 - Re: Fwd: Need help with Data Recovery on Ext4 partitions that became corrupted on running OS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 25 Sep 2013 21:41:55 -0400
From:	InvTraySts <invtrasys@...il.com>
To:	Eric Sandeen <sandeen@...hat.com>
Cc:	Jan Kara <jack@...e.cz>, linux-ext4@...r.kernel.org
Subject: Re: Fwd: Need help with Data Recovery on Ext4 partitions that became
 corrupted on running OS

After running e2fsck on the copied drive,
e2fsck -y /dev/sdf1
[long output]
Illegal double indirect block (1162627398) in inode 792606.  CLEARED.
Inode 792606 is too big.  Truncate? yes

Block #2206781 (1047) causes directory to be too big.  CLEARED.
Error storing directory block information (inode=792606, block=0,
num=818574): Memory allocation failed

root: ***** FILE SYSTEM WAS MODIFIED *****
e2fsck: aborted

root: ***** FILE SYSTEM WAS MODIFIED *****
root@...ver:~#

mount reports an error:
[793486.478664] EXT4-fs error (device sdf1):
htree_dirblock_to_tree:892: inode #2: block 20037: comm ls: bad entry
in directory: inode out of bounds - offset=0(0), inode=1162627398,
rec_len=48, name_len=3
[799147.110694] EXT4-fs (sdf1): ext4_check_descriptors: Checksum for
group 0 failed (32817!=0)
[799147.110698] EXT4-fs (sdf1): group descriptors corrupted!

On Wed, Sep 25, 2013 at 8:59 PM, Eric Sandeen <sandeen@...hat.com> wrote:
> On 9/25/13 7:08 PM, InvTraySts wrote:
>> (Going to merge these two back, because both of you are actually
>> helping me, but with the two conversations being segregated like this
>> it makes it hard to correlate with you both)
>> The partprobe did work with getting the partition table reread.
>> After that, the tune2fs sorta worked.
>> root@...ver:~# tune2fs -f -O ^has_journal /dev/sdf1
>> tune2fs 1.42.5 (29-Jul-2012)
>> root@...ver:~# mount /dev/sdf1 /media/tmp
>> root@...ver:~# ls -l /media/tmp/
>> total 0
>>
>> When I try and use the debugfs /dev/sdf1
>>
>> root@...ver:~# debugfs /dev/sdf1
>> debugfs 1.42.5 (29-Jul-2012)
>> debugfs:  ls
>> EXT2 directory corrupted
>> debugfs:  ls /
>> /: EXT2 directory corrupted
>
> At this point you could try e2fsck on the _copy_, to see what it
> can do.
>
> Seems like something quite bad may have happened to your storage,
> though, and e2fsck may not be magical for you.
>
> -Eric
>
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html