linux-ext4 - Re: ext4 recovery

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <FB71CEC8-E563-49DC-B39C-5DC1C002E5A9@dilger.ca>
Date:   Tue, 14 Jan 2020 13:35:42 -0700
From:   Andreas Dilger <adilger@...ger.ca>
To:     James Courtier-Dutton <james.dutton@...il.com>
Cc:     linux-ext4 <linux-ext4@...r.kernel.org>
Subject: Re: ext4 recovery

On Jan 14, 2020, at 9:03 AM, James Courtier-Dutton <james.dutton@...il.com> wrote:
> 
> Hi,
> 
> Say I started with 1 disk using LVM with an ext4 partition.
> I then added another disk. Added it to the LVM group, expanded the
> ext4 partition to then fill 2 disks.
> I then added another disk. Added it to the LVM group, expanded the
> ext4 partition to then fill 3 disks.
> 
> One of the disk has now failed.
> Are there any tools available for ext4 that could help recover this?
> Note, I am a single user, not a company, so there is no money to give
> to a data recovery company, so I wish to try myself.
> 
> Is there a mount option that will mount an ext4 partition even if
> there are lots of sector errors, or a missing disk. So, at least some
> of the files will be recoverable.
> Or a tool that will scan the disk for super blocks, then find inodes
> and then find the sector location of the files, even if they don't
> have filenames.

The first thing I would do is get new disk(s) to make a full backup of
the existing disks, so that whatever you do for recovery doesn't cause
further data loss.

There are two approaches to recovering the data:
- add in a replacement disk and re-add the missing LVs that fill in the
  lost space of the failed disk, then run e2fsck to rebuild the metadata
  for the missing disk.  I'm not sure how easy/hard this is with LVM.
- use a block-level scanner to recover files on disk, which is useful for
  e.g. .jpg images, or other files with good magic signatures and internal
  data integrity checks.

You didn't mention whether it was the first, second, or third disk that
failed.  If it is the third disk, that may not even need to be replaced,
since you could set the filesystem size to be the end of the second disk
and then e2fsck will repair the bad block/inode references.  If it is the
first or second disk then it is more complex.


Cheers, Andreas






Download attachment "signature.asc" of type "application/pgp-signature" (874 bytes)