linux-ext4 - Re: Recover files from a broken ext3 partition

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20131216145920.GA6991@thunk.org>
Date:	Mon, 16 Dec 2013 09:59:20 -0500
From:	Theodore Ts'o <tytso@....edu>
To:	Lars Noschinski <lars@...lic.noschinski.de>
Cc:	linux-ext4@...r.kernel.org
Subject: Re: Recover files from a broken ext3 partition

On Mon, Dec 16, 2013 at 03:46:43PM +0100, Lars Noschinski wrote:
> I have got a hard disk which was damaged by a fall and would like to
> recover a few files from that. (There is a backup for most of the
> data, but a handful of recent files are missing. These are important
> enough to spend some time on them, but not for paying a professional
> data recovery service).
> 
> Using GNU ddrescue I was able to read 99.8% of an ext3(or 4?)
> partition, so there's hope the data is still there. Unfortunately,
> some key parts of the file system seem to be damaged, so e2fsck fails:
> 
> - ------------------------------
> % ddrescuelog -l- -b4096 sdd5.ddrescue.log > badblocks.sdd5.4096
> % e2fsck -b 20480000 -v -f -L badblocks.sdd5.4096 sdd5
> [...]
> Pass 1: Checking inodes, blocks, and sizes
> Block 1 in the primary group descriptors is on the bad block list
> 
> If the block is really bad, the filesystem can not be fixed.
> You can remove this block from the bad block list and hope
> that the block is really OK.  But there are no guarantees.
> - ------------------------------
> [at 20480000 there seems to be an intact superblock; got the number
> (and the block size) from 'mke2fs -n']

What I'd suggest doing is making a complete copy of the disk using
ddrescue to a known good disk, and then run e2fsck on that.  It's
going to be simplest, most foolproof way to recover the data.  Yes it
will take a while, but you can let it run overnight...

     	    	       	       	   - Ted
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html