lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20131216145920.GA6991@thunk.org>
Date:	Mon, 16 Dec 2013 09:59:20 -0500
From:	Theodore Ts'o <tytso@....edu>
To:	Lars Noschinski <lars@...lic.noschinski.de>
Cc:	linux-ext4@...r.kernel.org
Subject: Re: Recover files from a broken ext3 partition

On Mon, Dec 16, 2013 at 03:46:43PM +0100, Lars Noschinski wrote:
> I have got a hard disk which was damaged by a fall and would like to
> recover a few files from that. (There is a backup for most of the
> data, but a handful of recent files are missing. These are important
> enough to spend some time on them, but not for paying a professional
> data recovery service).
> 
> Using GNU ddrescue I was able to read 99.8% of an ext3(or 4?)
> partition, so there's hope the data is still there. Unfortunately,
> some key parts of the file system seem to be damaged, so e2fsck fails:
> 
> - ------------------------------
> % ddrescuelog -l- -b4096 sdd5.ddrescue.log > badblocks.sdd5.4096
> % e2fsck -b 20480000 -v -f -L badblocks.sdd5.4096 sdd5
> [...]
> Pass 1: Checking inodes, blocks, and sizes
> Block 1 in the primary group descriptors is on the bad block list
> 
> If the block is really bad, the filesystem can not be fixed.
> You can remove this block from the bad block list and hope
> that the block is really OK.  But there are no guarantees.
> - ------------------------------
> [at 20480000 there seems to be an intact superblock; got the number
> (and the block size) from 'mke2fs -n']

What I'd suggest doing is making a complete copy of the disk using
ddrescue to a known good disk, and then run e2fsck on that.  It's
going to be simplest, most foolproof way to recover the data.  Yes it
will take a while, but you can let it run overnight...

     	    	       	       	   - Ted
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Powered by blists - more mailing lists