Accidentally issued "mkswap" on ext3 fs -- recovery possible?
ha haha
hahaha_30k at yahoo.com
Fri Jul 8 17:33:19 UTC 2005
Try to follow the steps below:
1, save all the contents on the partitions to another
hard disk, or a big file. So that you test work will
not destroy any useful data.
dd if=<mkswapped_partition> of=<someWhereToSave>
2, run " mkfs.ext3 -n <mkswapped_partition> " to get a
series of super-block backup copies. for example:
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200,
884736, 1605632, 2654208,
4096000, 7962624, 11239424, 20480000, 2388787
3, use the super block backups near the end of the
partitions to recovery file system structure.
e2fsck -b 20480000 <mkswapped_partition>
4, If the above doesn't work, try the following to
recover as many file contents as possible:
dd if=<mkswapped_partition> | strings > allStrings.txt
Then try to read the big jumboFile and recover
paragraphs.
--- Wolfram Schlich <lists at wolfram.schlich.org> wrote:
> Hi,
>
> I accidentally issued "mkswap" on a used ext3 fs
> partition (~30G) :-/
>
> I have analyzed the behaviour of mkswap using two
> test files and it
> appears to only change "some" bytes:
> --8<--
> --- swap2.xxd 2005-07-04 21:00:10.157261360 +0200
> +++ swap1.xxd 2005-07-04 21:00:01.894517488 +0200
> @@ -62,7 +62,7 @@
> 00003d0: 0000 0000 0000 0000 0000 0000 0000 0000
> ................
> 00003e0: 0000 0000 0000 0000 0000 0000 0000 0000
> ................
> 00003f0: 0000 0000 0000 0000 0000 0000 0000 0000
> ................
> -0000400: 0000 0000 0000 0000 0000 0000 0000 0000
> ................
> +0000400: 0100 0000 ff09 0000 0000 0000 0000 0000
> ................
> 0000410: 0000 0000 0000 0000 0000 0000 0000 0000
> ................
> 0000420: 0000 0000 0000 0000 0000 0000 0000 0000
> ................
> 0000430: 0000 0000 0000 0000 0000 0000 0000 0000
> ................
> @@ -253,7 +253,7 @@
> 0000fc0: 0000 0000 0000 0000 0000 0000 0000 0000
> ................
> 0000fd0: 0000 0000 0000 0000 0000 0000 0000 0000
> ................
> 0000fe0: 0000 0000 0000 0000 0000 0000 0000 0000
> ................
> -0000ff0: 0000 0000 0000 0000 0000 0000 0000 0000
> ................
> +0000ff0: 0000 0000 0000 5357 4150 5350 4143 4532
> ......SWAPSPACE2
> 0001000: 0000 0000 0000 0000 0000 0000 0000 0000
> ................
> 0001010: 0000 0000 0000 0000 0000 0000 0000 0000
> ................
> 0001020: 0000 0000 0000 0000 0000 0000 0000 0000
> ................
> --8<--
>
> I created an image (hdb1.img) of the damaged
> partition using dd
> and tried to work with various tools on it.
>
> Here is the output of 'fsck.ext3 -n -v hdb1.img':
> --8<--
> e2fsck 1.35 (28-Feb-2004)
> Couldn't find ext2 superblock, trying backup
> blocks...
> hdb1.img was not cleanly unmounted, check forced.
> Pass 1: Checking inodes, blocks, and sizes
> Pass 2: Checking directory structure
> Pass 3: Checking directory connectivity
> Pass 4: Checking reference counts
> Pass 5: Checking group summary information
> Free blocks count wrong for group #0 (24043,
> counted=0).
> Fix? no
>
> Free blocks count wrong for group #1 (32250,
> counted=0).
> Fix? no
>
> Free blocks count wrong for group #2 (32253,
> counted=0).
> Fix? no
>
> Free blocks count wrong for group #3 (32250,
> counted=158).
> Fix? no
>
> Free blocks count wrong for group #4 (32253,
> counted=8).
> Fix? no
>
> Free blocks count wrong for group #5 (32250,
> counted=28).
> Fix? no
>
> Free blocks count wrong for group #6 (32253,
> counted=6822).
> Fix? no
>
> Free blocks count wrong for group #7 (32250,
> counted=10428).
> Fix? no
>
> Free blocks count wrong for group #8 (32253,
> counted=11170).
> Fix? no
>
> Free blocks count wrong for group #9 (32250,
> counted=4239).
> Fix? no
>
> Free blocks count wrong for group #10 (32253,
> counted=24482).
> Fix? no
>
> Free blocks count wrong for group #11 (32253,
> counted=21184).
> Fix? no
>
> Free blocks count wrong for group #12 (32253,
> counted=25657).
> Fix? no
>
> Free blocks count wrong for group #13 (32253,
> counted=13674).
> Fix? no
>
> Free blocks count wrong for group #14 (32253,
> counted=15007).
> Fix? no
>
> Free blocks count wrong for group #15 (32253,
> counted=11366).
> Fix? no
>
> [ removed many lines, complete log file at
>
>
http://wolfram.schlich.org/tmp/fsck.ext3_-n_-v_hdb1.img
> ]
>
> Free inodes count wrong for group #213 (16416,
> counted=14498).
> Fix? no
>
> Directories count wrong for group #213 (0,
> counted=241).
> Fix? no
>
> Free inodes count wrong for group #214 (16416,
> counted=14524).
> Fix? no
>
> Directories count wrong for group #214 (0,
> counted=126).
> Fix? no
>
> Free inodes count wrong for group #215 (16416,
> counted=14441).
> Fix? no
>
> Directories count wrong for group #215 (0,
> counted=114).
> Fix? no
>
> Free inodes count wrong for group #216 (16416,
> counted=15214).
> Fix? no
>
> Directories count wrong for group #216 (0,
> counted=99).
> Fix? no
>
> Free inodes count wrong for group #217 (16416,
> counted=14898).
> Fix? no
>
> Directories count wrong for group #217 (0,
> counted=216).
> Fix? no
>
> Free inodes count wrong for group #218 (16416,
> counted=14878).
> Fix? no
>
> Directories count wrong for group #218 (0,
> counted=187).
> Fix? no
>
> Free inodes count wrong for group #219 (16416,
> counted=16033).
> Fix? no
>
> Directories count wrong for group #219 (0,
> counted=37).
> Fix? no
>
> Free inodes count wrong for group #220 (16416,
> counted=14949).
> Fix? no
>
> Directories count wrong for group #220 (0,
> counted=128).
> Fix? no
>
> Free inodes count wrong for group #221 (16416,
> counted=15167).
> Fix? no
>
> Directories count wrong for group #221 (0,
> counted=102).
>
=== message truncated ===
____________________________________________________
Sell on Yahoo! Auctions no fees. Bid on great items.
http://auctions.yahoo.com/
More information about the Ext3-users
mailing list