[prev in list] [next in list] [prev in thread] [next in thread]
List: ext3-users
Subject: [solved] Overwritten beginning of ext3 filesystem. Recovery?
From: Florian Weber <Florian.Weber () pfaffenhofen ! de>
Date: 2011-02-06 17:23:57
Message-ID: 201102061824.02169.Florian.Weber () pfaffenhofen ! de
[Download RAW message or body]
Hello list
For the benefit of those searching the archives, here's how I got out of the
mess described in my first mail on27dec2010.
0a. Be extra careful and use your brain before even touching the keyboard. Go
to extreme measures to prevent typos.
0b. Keep backups: make a dd copy of your disk/partition and put the original
hardware into a safe. Do not work on the master image. Make it read-only,
create _another_ working copy and use _that_ for recovery. You will make
mistakes and you do not want to touch the hardware.
0c. Be prepared to learn a lot of things about filesystems you never wanted to
know.
0c. Whatevery you do, check the units your tools are using. Each time. They
might be filesystem blocks, disk blocks, inodes, bytes, kB, kiB, ....
0d. Have a look at the thread "recovery recommendations" started by "m.p." on
21jan2011
1. I overwrote the stuff I definitely knew to be faulty with zeroes, i.e. the
first 10GB. I erred on the safe side, rather keeping bogus stuff than deleting
good data.
2. This action killed my partition table. I had to restore it manually but was
prepared for that.
3. I ran e2fsck on the broken partition. After the first run, it prompted me to
be run again, which I did.
4. The filesystem now contained lost+found/ as it's only toplevel directory.
Below that were many files and directories
5. I sorted those files/dirs and gave them meaningful names instead of block
numbers. About 70% were recognizable from their content, among it *all* my
personal data! The rest was unrecognizable binary and ASCII fragments which I
discarded, there's a high likelyhood that most of it was actually deleted in
the old filesystem, and it couldn't be restored anyway.
6. I compared against very old backups which showed no data loss.
7. I'm still doing lots of random samples to check for damaged files and loss
of newer files, but found none so far.
Conclusions:
I got all my data back, but that was pure luck.
To account not only for hardware but also for software and human failures, I
have bought a USB harddisk which I use for weekly backups. I'm still
evaluating which backup tools best fit my needs.
Hope this helps someone.
With best regards,
Florian Weber
_______________________________________________
Ext3-users mailing list
Ext3-users@redhat.com
https://www.redhat.com/mailman/listinfo/ext3-users
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic