linux-ext4 - Recover files from a broken ext3 partition

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 16 Dec 2013 15:46:43 +0100
From:	Lars Noschinski <lars@...lic.noschinski.de>
To:	linux-ext4@...r.kernel.org
Subject: Recover files from a broken ext3 partition

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[Please tell me if this message is not appropriate here, but the
ext3-users ML seems to be dead since a few months]

Hi everyone,

I have got a hard disk which was damaged by a fall and would like to
recover a few files from that. (There is a backup for most of the
data, but a handful of recent files are missing. These are important
enough to spend some time on them, but not for paying a professional
data recovery service).

Using GNU ddrescue I was able to read 99.8% of an ext3(or 4?)
partition, so there's hope the data is still there. Unfortunately,
some key parts of the file system seem to be damaged, so e2fsck fails:

- ------------------------------
% ddrescuelog -l- -b4096 sdd5.ddrescue.log > badblocks.sdd5.4096
% e2fsck -b 20480000 -v -f -L badblocks.sdd5.4096 sdd5
[...]
Pass 1: Checking inodes, blocks, and sizes
Block 1 in the primary group descriptors is on the bad block list

If the block is really bad, the filesystem can not be fixed.
You can remove this block from the bad block list and hope
that the block is really OK.  But there are no guarantees.
- ------------------------------
[at 20480000 there seems to be an intact superblock; got the number
(and the block size) from 'mke2fs -n']

The files I am interested in are located under /home/$USER/Desktop and
/home/$USER/Dokumente; so I tried accessing them with debugfs.
Unfortunately, /home/$USER seems to be corrupted:

- ------------------------------
% LESS=FSRX debugfs -s 20480000 -b 4096 sdd5
debugfs 1.42.8 (20-Jun-2013)
debugfs:  cd /home/$USER
debugfs:  ls

EXT2 directory corrupted
- ------------------------------

So, any hints for me how to proceed? Is there a way to access the
Desktop and Dokumente subdirectories (provided they are themselves
undamaged)?

Also, I interrupted ddrescue for my access attempt (because it takes
really long to get all the still-good sectors from a 200GB partition).
Can debugfs show me where on the disk /home/$USER is located? This
would allow me to instruct ddrescue to concentrate on these parts.

  Best regards, Lars
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)
Comment: Using GnuPG with Icedove - http://www.enigmail.net/

iQEcBAEBAgAGBQJSrxJTAAoJEOUX5T7UhMS6WbEIAN1FUBc2U9o9Vrad0jtMbZDM
xD7tkr5+Z/dxefW/kQQk3eh4f+oqIKQgx8nCVOD84/Of7Oc9JHvKmROj4KBcf0C1
APa04JiYfa5RY+6wGAeKS896/C8qABCV6toHJ5ko1ZxgLTFTiiWeIlepsW77cPJ4
5jYLdjI0V4qHbPOxRE3aRABk57fe20YNoiNtdKU7scgz6Vbd8JwL/5D1tH0+5l2r
kRMModB7+kWl2e/Q7vy9721clXRnkyAr03Q+eg/n/h8P39qee1B+fhnwhWWJvZWt
yAdNtLKDc/rJ7Sths0fJqSiNo220j0FSSD/YCBJVe3XehwHRIo0RYHn/RrVqo3M=
=yfSt
-----END PGP SIGNATURE-----
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html