Overwriting ext2 Partition with ext3
evilninja at gmx.net
Wed Jul 7 10:23:15 UTC 2004
-----BEGIN PGP SIGNED MESSAGE-----
Niki Hammler schrieb:
> mke2fs -j /device
> Important is the "-j" switch.
> What happens without the "-j" switch? All superblocks and inodes
> are overwritten. Is this true??
i don't think, that all inodes are overwritten. mkfs.?fs is pretty fast,
so it's creating the superblock and the journal (-j) only.
> However, can you tell me if it is theoretically possible to recover data
> maybe even with meta info (file name)?
> Then I would give my harddrive to a professional recover company.
we had a case here, where *something* has corrupted our shiny RAID-5
ext3fs. also we felt safe having a RAID-5, a fsck has moved a lot to
lost+found, leaving nothing in the normal dir-tree. we were still
missing a lot important files. we then tried several ext2/ext3 recovery
tools (e2undel, recover, playing with debugfs), but all seem to fail. we
happend to have a windoze machine around and we had some more luck with
a tool called "R-Linux":
and despite the usual "it's impossible to recover data from ext3" we
were able to recover a lot of files, that didn't make it to lost+found.
BOFH excuse #405:
Sysadmins unavailable because they are in a meeting talking about why
they are unavailable so much.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
-----END PGP SIGNATURE-----
More information about the Ext3-users