| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Sat, 23 Jul 2016 23:16:33 +0000 (UTC)
From: Bhatia Amit <amitbhatia@...ketmail.com>
To: "linux-ext4@...r.kernel.org" <linux-ext4@...r.kernel.org>
Subject: Recovering folder and files from ext4 partition
Hi
I have a WD Live duo 2*3TB drives, which was setup in RAID1 mirror configuration. The unit failed with one drive totally inaccessible. I pulled the second drive out and connected it to a Linux laptop via a standalone enclosure via sata.
Using a r-linux scan tool on fourth partition sdc4, it shows me files that are relevant to me, but has no folder structure information. So, getting folder information out from the disk would be extremely valuable. Also, the files seem to have lost their original name.
When trying to start the array on the disk, I was unable to start it, and described the whole problem on linux-raid mailing list.
http://marc.info/?l=linux-raid&m=146878562322359&w=2
I got lot of help from Phil on the raid list, to decipher the issue. The last update today was that apparently the disk has some very old (not relevant to me) data and some new (relevant) data. The superblocks in start of the disk seem to refer to 2012 data while that last superblock refers to 2016 data. Phil thinks that folder information for the new relevant data is in the first half of the disk, but that folder information is missing. He suggested describe my problem on this list, to get any advice. I have repeated the superblock information here to start this discussion. Out of the many superblocks that r-linux found on disk, I have pasted the first, middle'ish and last superblock content here. I can paste other superblocks too based on any suggestion.
Any suggestion on getting file and folder information from this disk would be very helpful.
Thanks
Amit
$ cat sblock.txt
Name: Ext2/Ext3/Ext4 SuperBlock
Offset (in sectors): 8387584
Size (in sectors): 2
Sector 8387584 (Parent: WDC WD30EZRX-00D8PB0 80.00A80 Record: 17419264)
FFF80000: 00 46 B7 02 5F 8C B9 02 - 00 00 00 00 62 25 B6 02 .F.._.......b%..
FFF80010: 1A 3B B7 02 00 00 00 00 - 06 00 00 00 06 00 00 00 .;..............
FFF80020: F8 FF 00 00 F8 FF 00 00 - 00 FF 00 00 43 3E B3 4F ............C>.O
FFF80030: 47 9D BA 50 03 00 1B 00 - 53 EF 00 00 01 00 00 00 G..P....S.......
FFF80040: 3B B5 02 00 00 4E ED 00 - 00 00 00 00 01 00 00 00 ;....N..........
FFF80050: 00 00 00 00 0B 00 00 00 - 00 01 01 00 3C 00 00 00 ............<...
FFF80060: 42 02 00 00 7B 00 00 00 - B6 7F 9F FD 12 BF 4D 57 B...{.........MW
FFF80070: A8 34 DD 09 E9 E8 BA C0 - 00 00 00 00 00 00 00 00 .4..............
FFF80080: 00 00 00 00 00 00 00 00 - 2F 43 61 63 68 65 56 6F ......../CacheVo
FFF80090: 6C 75 6D 65 00 C8 24 9E - 20 22 82 24 22 C8 1B 60 lume..$. ".$"..`
FFF800A0: 60 FF FF FF 9C CA D0 E4 - 5C C8 13 41 80 C0 10 E6 `.......\..A....
FFF800B0: 68 C8 08 21 60 CA D0 E4 - 5C 00 00 00 00 CD AC 46 h..!`...\......F
FFF800C0: 80 C8 1C 5A 60 C8 24 9E - 00 00 00 00 00 00 20 00 ...Z`.$....... .
FFF800D0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
FFF800E0: 08 00 00 00 00 00 00 00 - 00 00 00 00 FC ED 10 2F .............../
FFF800F0: 38 44 66 85 D0 AC 7C A3 - FF F3 B0 AF 01 01 00 00 8Df...|.........
FFF80100: 00 00 00 00 00 00 00 00 - 3B B5 02 00 0A F3 02 00 ........;.......
FFF80110: 04 00 00 00 00 00 00 00 - 00 00 00 00 FF 7F 00 00 ................
FFF80120: 78 EA B0 02 FF 7F 00 00 - 01 00 00 00 77 6A B1 02 x...........wj..
FFF80130: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
FFF80140: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 80 ................
FFF80150: 00 00 00 00 00 00 00 00 - 00 00 00 00 1C 00 1C 00 ................
FFF80160: 02 00 00 00 FF 78 00 00 - 00 00 00 00 00 00 00 00 .....x..........
FFF80170: 00 00 00 00 04 00 00 00 - 94 F3 87 01 00 00 00 00 ................
FFF80180: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
FFF80190: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
FFF801A0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
FFF801B0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
FFF801C0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
FFF801D0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
FFF801E0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
FFF801F0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
Name: Ext2/Ext3/Ext4 SuperBlock
Offset (in sectors): 2038182912
Size (in sectors): 2
Sector 2038182912 (Parent: WDC WD30EZRX-00D8PB0 80.00A80 Record: 2047214592)
F2F8680000: 00 46 B7 02 5F 8C B9 02 - 00 00 00 00 62 25 B6 02 .F.._.......b%..
F2F8680010: 1A 3B B7 02 00 00 00 00 - 06 00 00 00 06 00 00 00 .;..............
F2F8680020: F8 FF 00 00 F8 FF 00 00 - 00 FF 00 00 43 3E B3 4F ............C>.O
F2F8680030: 47 9D BA 50 03 00 1B 00 - 53 EF 00 00 01 00 00 00 G..P....S.......
F2F8680040: 3B B5 02 00 00 4E ED 00 - 00 00 00 00 01 00 00 00 ;....N..........
F2F8680050: 00 00 00 00 0B 00 00 00 - 00 01 F3 00 3C 00 00 00 ............<...
F2F8680060: 42 02 00 00 7B 00 00 00 - B6 7F 9F FD 12 BF 4D 57 B...{.........MW
F2F8680070: A8 34 DD 09 E9 E8 BA C0 - 00 00 00 00 00 00 00 00 .4..............
F2F8680080: 00 00 00 00 00 00 00 00 - 2F 43 61 63 68 65 56 6F ......../CacheVo
F2F8680090: 6C 75 6D 65 00 C8 24 9E - 20 22 82 24 22 C8 1B 60 lume..$. ".$"..`
F2F86800A0: 60 FF FF FF 9C CA D0 E4 - 5C C8 13 41 80 C0 10 E6 `.......\..A....
F2F86800B0: 68 C8 08 21 60 CA D0 E4 - 5C 00 00 00 00 CD AC 46 h..!`...\......F
F2F86800C0: 80 C8 1C 5A 60 C8 24 9E - 00 00 00 00 00 00 20 00 ...Z`.$....... .
F2F86800D0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
F2F86800E0: 08 00 00 00 00 00 00 00 - 00 00 00 00 FC ED 10 2F .............../
F2F86800F0: 38 44 66 85 D0 AC 7C A3 - FF F3 B0 AF 01 01 00 00 8Df...|.........
F2F8680100: 00 00 00 00 00 00 00 00 - 3B B5 02 00 0A F3 02 00 ........;.......
F2F8680110: 04 00 00 00 00 00 00 00 - 00 00 00 00 FF 7F 00 00 ................
F2F8680120: 78 EA B0 02 FF 7F 00 00 - 01 00 00 00 77 6A B1 02 x...........wj..
F2F8680130: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
F2F8680140: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 80 ................
F2F8680150: 00 00 00 00 00 00 00 00 - 00 00 00 00 1C 00 1C 00 ................
F2F8680160: 02 00 00 00 FF 78 00 00 - 00 00 00 00 00 00 00 00 .....x..........
F2F8680170: 00 00 00 00 04 00 00 00 - 94 F3 87 01 00 00 00 00 ................
F2F8680180: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
F2F8680190: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
F2F86801A0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
F2F86801B0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
F2F86801C0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
F2F86801D0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
F2F86801E0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
F2F86801F0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
Name: Ext2/Ext3/Ext4 SuperBlock
Offset (in sectors): 5781334786
Size (in sectors): 2
Sector 5781334786 (Parent: WDC WD30EZRX-00D8PB0 80.00A80 Record: 5790366466)
2B130560400: 00 46 B7 02 5F 8C B9 02 - 00 00 00 00 25 7F 09 02 .F.._.......%...
2B130560410: DC F8 99 02 00 00 00 00 - 06 00 00 00 06 00 00 00 ................
2B130560420: F8 FF 00 00 F8 FF 00 00 - 00 FF 00 00 6D C8 02 57 ............m..W
2B130560430: 6D C8 02 57 2E 00 1B 00 - 53 EF 01 00 01 00 00 00 m..W....S.......
2B130560440: 3B B5 02 00 00 4E ED 00 - 00 00 00 00 01 00 00 00 ;....N..........
2B130560450: 00 00 00 00 0B 00 00 00 - 00 01 00 00 3C 00 00 00 ............<...
2B130560460: 46 02 00 00 7B 00 00 00 - B6 7F 9F FD 12 BF 4D 57 F...{.........MW
2B130560470: A8 34 DD 09 E9 E8 BA C0 - 00 00 00 00 00 00 00 00 .4..............
2B130560480: 00 00 00 00 00 00 00 00 - 2F 43 61 63 68 65 56 6F ......../CacheVo
2B130560490: 6C 75 6D 65 00 C7 4B BE - 20 24 82 24 82 C8 1B A0 lume..K. $.$....
2B1305604A0: 60 FF FF FF 9C C0 F1 11 - DC C8 13 2A A0 C0 10 E6 `..........*....
2B1305604B0: 68 C8 08 21 60 C0 F1 11 - DC 00 00 00 00 CF 3D 2A h..!`.........=*
2B1305604C0: E0 C2 94 C1 60 C7 4B BE - 00 00 00 00 00 00 20 00 ....`.K....... .
2B1305604D0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
2B1305604E0: 08 00 00 00 00 00 00 00 - 00 00 00 00 FC ED 10 2F .............../
2B1305604F0: 38 44 66 85 D0 AC 7C A3 - FF F3 B0 AF 01 01 00 00 8Df...|.........
2B130560500: 00 00 00 00 00 00 00 00 - 3B B5 02 00 0A F3 02 00 ........;.......
2B130560510: 04 00 00 00 00 00 00 00 - 00 00 00 00 FF 7F 00 00 ................
2B130560520: 78 EA B0 02 FF 7F 00 00 - 01 00 00 00 77 6A B1 02 x...........wj..
2B130560530: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
2B130560540: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 80 ................
2B130560550: 00 00 00 00 00 00 00 00 - 00 00 00 00 1C 00 1C 00 ................
2B130560560: 02 00 00 00 FF 78 00 00 - 00 00 00 00 00 00 00 00 .....x..........
2B130560570: 00 00 00 00 04 00 00 00 - D4 DD EB 54 00 00 00 00 ...........T....
2B130560580: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
2B130560590: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
2B1305605A0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
2B1305605B0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
2B1305605C0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
2B1305605D0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
2B1305605E0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
2B1305605F0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists