"Guessing" superblock parameters

[Niki Hammler]

Hi again,

I have the following scenario: I've got a partition which has exactly 
14659312 blocks:

$ fdisk -l /dev/hda
Disk /dev/hda: 28.5 GB, 28520497152 bytes
255 heads, 63 sectors/track, 3467 cylinders
Units = Zylinder of 16065 * 512 = 8225280 bytes
     Gerät Boot      Start         End      Blocks   Id  System
(...)
/dev/hda4            1643        3467    14659312+  83  Linux
(...)

Long, long time ago (5,6 years) I formatted this partition using a 
simple "mke2fs /dev/hda4" call. Block size is 4096. On 5th July, 2004, I 
accidently reformatted the partition with

mke2fs -j /dev/hda4

without having a backup. Silly.
(take a look at the '-j' switch which creates a journal!)
After that, I spent weeks in reconstructing data and had partial 
success. I could reconstruct lots of mails, mysql tables, PHP documents 
and so on using self written scripts. The most important data. Even a 
50MB gpg compressed file with finding indirect blocks.
After that, I saved the image to disk, reformatted the partition and 
kept on working ;-)

Last week, I searched for a file I've lost on that image. I just won't 
realize that my data is lost. It's still out there ;-)

So I wrote a small program that finds all directory entries and had 
partial success: Most directory entries were found and in small 
directories with small files, the data in it followed the directory 
entry so that I could reconstruct whole directories.


Now, I had the idea of searching for inodes. Maybe not all inodes are 
overwritten? What would you say? Are there chances that some inodes are 
not overwritten? Or are they all lost? Overwritten by zeros?
Maybe not all of them are overwritten because of the '-j' switch?


I modified the program "e2salvage" to find all inodes. I know, I had ~ 
117807 files and directories on the disk. e2salvage found 85064 inodes.
But I have the problem that on the disk there was an image (~1GB) with a 
whole Linux file system. I think block size also 4096.
Do you think the inodes are from that image or could the inodes be from 
my data file system itself?

And now the important question: Even if I would find a few inodes, they 
are useless, unless I know the addresses of the inode tables for each 
block group.
Is there a way to reconstruct/guess the superblock parameters (block 
groups, inode tables, ...) if I have the the exact size of the partition 
and the block size (4096)? I also know that I've taken the default 
parameters for mke2fs.

Is the filesystem (offset of inode tables, ...) the same everytime I 
format the same partition? If not, why?


Thank you very much in advance!



Niki