Overwriting ext2 Partition with ext3

Niki Hammler nhammler at scc.co.at
Tue Jul 6 15:02:12 UTC 2004


Hi,

Suppose you have an ext2 Partition at 14GB which is 80-90% full.
Most files are smaller than 1 MB (there are just 20 or so which are
over 100MB where 800MB is the biggest one).
Block size etc - everything is default.

Now you do this:

mke2fs -j /device

Important is the "-j" switch.

What happens without the "-j" switch? All superblocks and inodes
are overwritten. Is this true??
If so, the data isn't lost but the meta info.
Is there a chance to restore some of the data?
Suppose, the block size is 4KB. Then I could easily restore every
file which is less or equal 4K. Is this true?
If a file is bigger is there a chance of restoring some data?

Now suppose doing it with the "-j" switch. This adds a journal.
Where is this journal written and how big is it? If the journal is written
and the beginning of the drive, there is a chance, that not all of the meta
data isn't destroyed. Is this true?
Is there a chance to recover some of the data?
Is there a tool for examining ext2 partitions WITHOUT meta info? So that
it could be possible to recover some of the data?

Yes, this happend to me. I typed mke2fs instead of tune2fs. I know, I should
have a backup. Damn!
However, can you tell me if it is theoretically possible to recover data
maybe even with meta info (file name)?
Then I would give my harddrive to a professional recover company.

AND, maybe important: I have a textfile containing all files (and dirs) on
the harddrive with full path and size in
kilobytes. I've done this few days ago with find. But the files are not in
right order,
they are ordered by size.

Can anybody help me??

Thanks a lot!

Niki







More information about the Ext3-users mailing list