lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Fri, 10 Feb 2012 18:36:52 +0000 (GMT)
From:	Rudolf Zran <>
To:	Theodore Tso <tytso@....EDU>
Cc:	"" <>,
	"" <>
Subject: Re: Restoring filenames from partly damaged ext4-filesystem

Hello Ted!

>>  I recently damaged an ext4 partition by accident
>>  Maybe somebody knows a good method to just "repair" the
>> ext4-structure from the remaining part of the partition?
> Have you tried just simply running e2fsck, specifying an alternate superblock?

Yes of course I tried, as I wrote in my original post ($SBOK is one
of the intact superblocks at 11239424, 20480000, 23887872, 71663616,
78675968 and 214990848).

With "all answers: no":

>> * "fsck.ext4 -b $SBOK -B 4096 -v -n /dev/loop0" shows a lot of errors.
>>   Filesystem isn't mountable afterwards

# fsck.ext4 -b 214990848 -B 4096 -v -n /dev/loop0
e2fsck 1.41.12 (17-May-2010)
One or more block group descriptor checksums are invalid.  Fix? no
Group descriptor 0 checksum is invalid.  IGNORED.
Group descriptor 1 checksum is invalid.  IGNORED.
Group descriptor 7451 checksum is invalid.  IGNORED.
Group descriptor 7452 checksum is invalid.  IGNORED.
/dev/loop0 contains a file system with errors, check forced.
Resize inode not valid.  Recreate? no
Pass 1: Checking inodes, blocks, and sizes
Root inode is not a directory.  Clear? no
Inode 5 should not have EOFBLOCKS_FL set (size 2642074971391648798, lblk -1)
Clear? no

# mount -o ro /dev/loop0 /mnt
mount: /dev/loop0: can't read superblock

# dmesg 
[504508.215515] EXT4-fs error (device loop0): ext4_iget: bad extended attribute block 1920620055 in inode #2
[504508.215530] EXT4-fs (loop0): get root inode failed
[504508.215534] EXT4-fs (loop0): mount failed

With "all answers: yes":

>> * "fsck.ext4 -b $SBOK -B 4096 -v -y /dev/loop0" recoveres after a long time.
>>   Filesystem is mountable. Root is empty besides lost+found folder, which
>>   contains about 300GB mostly useless data: Millions of files with wrong
>>   permissions, useless names and some random content.

> I'd do this by making a copy of the file system first, of course….

For sure! :) I solely work on copies.

Thanks, Rudolf.
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to
More majordomo info at

Powered by blists - more mailing lists