linux-ext4 - Re: Restoring filenames from partly damaged ext4-filesystem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 10 Feb 2012 18:36:52 +0000 (GMT)
From:	Rudolf Zran <rudolfzran@...oo.com>
To:	Theodore Tso <tytso@....EDU>
Cc:	"linux-ext4@...r.kernel.org" <linux-ext4@...r.kernel.org>,
	"debian-user@...ts.debian.org" <debian-user@...ts.debian.org>
Subject: Re: Restoring filenames from partly damaged ext4-filesystem

Hello Ted!

>>  I recently damaged an ext4 partition by accident
[...]
>>  Maybe somebody knows a good method to just "repair" the
>> ext4-structure from the remaining part of the partition?
> 
> Have you tried just simply running e2fsck, specifying an alternate superblock?

Yes of course I tried, as I wrote in my original post ($SBOK is one
of the intact superblocks at 11239424, 20480000, 23887872, 71663616,
78675968 and 214990848).

With "all answers: no":

>> * "fsck.ext4 -b $SBOK -B 4096 -v -n /dev/loop0" shows a lot of errors.
>>   Filesystem isn't mountable afterwards

# fsck.ext4 -b 214990848 -B 4096 -v -n /dev/loop0
e2fsck 1.41.12 (17-May-2010)
One or more block group descriptor checksums are invalid.  Fix? no
Group descriptor 0 checksum is invalid.  IGNORED.
Group descriptor 1 checksum is invalid.  IGNORED.
...
Group descriptor 7451 checksum is invalid.  IGNORED.
Group descriptor 7452 checksum is invalid.  IGNORED.
/dev/loop0 contains a file system with errors, check forced.
Resize inode not valid.  Recreate? no
Pass 1: Checking inodes, blocks, and sizes
Root inode is not a directory.  Clear? no
Inode 5 should not have EOFBLOCKS_FL set (size 2642074971391648798, lblk -1)
Clear? no
...

# mount -o ro /dev/loop0 /mnt
mount: /dev/loop0: can't read superblock

# dmesg 
[504508.215515] EXT4-fs error (device loop0): ext4_iget: bad extended attribute block 1920620055 in inode #2
[504508.215530] EXT4-fs (loop0): get root inode failed
[504508.215534] EXT4-fs (loop0): mount failed

With "all answers: yes":

>> * "fsck.ext4 -b $SBOK -B 4096 -v -y /dev/loop0" recoveres after a long time.
>>   Filesystem is mountable. Root is empty besides lost+found folder, which
>>   contains about 300GB mostly useless data: Millions of files with wrong
>>   permissions, useless names and some random content.

> I'd do this by making a copy of the file system first, of course….

For sure! :) I solely work on copies.

Thanks, Rudolf.
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html