Trying to recover corrupted journal

Markus Peuhkuri puhuri at iki.fi
Wed Dec 15 17:01:45 UTC 2004


My IDE disk went bad (surprising S.M.A.R.T indicated that it was ok, 
still getting some errors).  I managed to copy most of 120 GB partition 
with dd_recover, only something like 600 blocks was unreadable.

After 'e2fsck -y' (or would -p been better?) most of important data not 
found from backups was restored.  However, one important file is still 
missing (an older copy exists so everything is not lost).    Apparently 
it was open or was written to disk when disk errors started.

If I look disk image file with debugfs, the file is listed in the right 
directory but if I try to dump it, I get zero-sized file (btw what are 
the fields in debugfs ls -command?).

One of problems is that journal was corrupted (has a wrong magic number; 
possibly a read error just at start).  Is there some way to try to 
recover part of the journal?

One idea is that I try to search blocks for the start of file (OOo sxc: 
"PK\003\004\024\0\0"..."mimetypeapplication/vnd.sun.xml.calc") but after 
that the problem is to locate the rest 15 blocks.  How the journal is 
organized?

Is there any detailed documentation (in addition to kernel sources :-)
on ext3 journal, most of documentation I found was for ext2 and didn't 
cover journalling at all?

-- 
http://iki.fi/puhuri




More information about the Ext3-users mailing list