Accidentally issued "mkswap" on ext3 fs -- recovery possible?

[ha haha]

Try to follow the steps below:

1, save all the contents on the partitions to another
hard disk, or a big file. So that you test work will
not destroy any useful data.

 dd if=<mkswapped_partition> of=<someWhereToSave>

2, run " mkfs.ext3 -n <mkswapped_partition> " to get a
series of super-block backup copies. for example:

Superblock backups stored on blocks: 
        32768, 98304, 163840, 229376, 294912, 819200,
884736, 1605632, 2654208, 
        4096000, 7962624, 11239424, 20480000, 2388787



3, use the super block backups near the end of the
partitions to recovery file system structure.

 e2fsck -b 20480000 <mkswapped_partition>

4, If the above doesn't work, try the following to
recover as many file contents as possible:

dd if=<mkswapped_partition> | strings > allStrings.txt

Then try to read the big jumboFile and recover
paragraphs.

 


--- Wolfram Schlich <lists at wolfram.schlich.org> wrote:

> Hi,
> 
> I accidentally issued "mkswap" on a used ext3 fs
> partition (~30G) :-/
> 
> I have analyzed the behaviour of mkswap using two
> test files and it
> appears to only change "some" bytes:
> --8<--
> --- swap2.xxd   2005-07-04 21:00:10.157261360 +0200
> +++ swap1.xxd   2005-07-04 21:00:01.894517488 +0200
> @@ -62,7 +62,7 @@
>  00003d0: 0000 0000 0000 0000 0000 0000 0000 0000 
> ................
>  00003e0: 0000 0000 0000 0000 0000 0000 0000 0000 
> ................
>  00003f0: 0000 0000 0000 0000 0000 0000 0000 0000 
> ................
> -0000400: 0000 0000 0000 0000 0000 0000 0000 0000 
> ................
> +0000400: 0100 0000 ff09 0000 0000 0000 0000 0000 
> ................
>  0000410: 0000 0000 0000 0000 0000 0000 0000 0000 
> ................
>  0000420: 0000 0000 0000 0000 0000 0000 0000 0000 
> ................
>  0000430: 0000 0000 0000 0000 0000 0000 0000 0000 
> ................
> @@ -253,7 +253,7 @@
>  0000fc0: 0000 0000 0000 0000 0000 0000 0000 0000 
> ................
>  0000fd0: 0000 0000 0000 0000 0000 0000 0000 0000 
> ................
>  0000fe0: 0000 0000 0000 0000 0000 0000 0000 0000 
> ................
> -0000ff0: 0000 0000 0000 0000 0000 0000 0000 0000 
> ................
> +0000ff0: 0000 0000 0000 5357 4150 5350 4143 4532 
> ......SWAPSPACE2
>  0001000: 0000 0000 0000 0000 0000 0000 0000 0000 
> ................
>  0001010: 0000 0000 0000 0000 0000 0000 0000 0000 
> ................
>  0001020: 0000 0000 0000 0000 0000 0000 0000 0000 
> ................
> --8<--
> 
> I created an image (hdb1.img) of the damaged
> partition using dd
> and tried to work with various tools on it.
> 
> Here is the output of 'fsck.ext3 -n -v hdb1.img':
> --8<--
> e2fsck 1.35 (28-Feb-2004)
> Couldn't find ext2 superblock, trying backup
> blocks...
> hdb1.img was not cleanly unmounted, check forced.
> Pass 1: Checking inodes, blocks, and sizes
> Pass 2: Checking directory structure
> Pass 3: Checking directory connectivity
> Pass 4: Checking reference counts
> Pass 5: Checking group summary information
> Free blocks count wrong for group #0 (24043,
> counted=0).
> Fix? no
> 
> Free blocks count wrong for group #1 (32250,
> counted=0).
> Fix? no
> 
> Free blocks count wrong for group #2 (32253,
> counted=0).
> Fix? no
> 
> Free blocks count wrong for group #3 (32250,
> counted=158).
> Fix? no
> 
> Free blocks count wrong for group #4 (32253,
> counted=8).
> Fix? no
> 
> Free blocks count wrong for group #5 (32250,
> counted=28).
> Fix? no
> 
> Free blocks count wrong for group #6 (32253,
> counted=6822).
> Fix? no
> 
> Free blocks count wrong for group #7 (32250,
> counted=10428).
> Fix? no
> 
> Free blocks count wrong for group #8 (32253,
> counted=11170).
> Fix? no
> 
> Free blocks count wrong for group #9 (32250,
> counted=4239).
> Fix? no
> 
> Free blocks count wrong for group #10 (32253,
> counted=24482).
> Fix? no
> 
> Free blocks count wrong for group #11 (32253,
> counted=21184).
> Fix? no
> 
> Free blocks count wrong for group #12 (32253,
> counted=25657).
> Fix? no
> 
> Free blocks count wrong for group #13 (32253,
> counted=13674).
> Fix? no
> 
> Free blocks count wrong for group #14 (32253,
> counted=15007).
> Fix? no
> 
> Free blocks count wrong for group #15 (32253,
> counted=11366).
> Fix? no
> 
> [ removed many lines, complete log file at
>  
>
http://wolfram.schlich.org/tmp/fsck.ext3_-n_-v_hdb1.img
> ]
> 
> Free inodes count wrong for group #213 (16416,
> counted=14498).
> Fix? no
> 
> Directories count wrong for group #213 (0,
> counted=241).
> Fix? no
> 
> Free inodes count wrong for group #214 (16416,
> counted=14524).
> Fix? no
> 
> Directories count wrong for group #214 (0,
> counted=126).
> Fix? no
> 
> Free inodes count wrong for group #215 (16416,
> counted=14441).
> Fix? no
> 
> Directories count wrong for group #215 (0,
> counted=114).
> Fix? no
> 
> Free inodes count wrong for group #216 (16416,
> counted=15214).
> Fix? no
> 
> Directories count wrong for group #216 (0,
> counted=99).
> Fix? no
> 
> Free inodes count wrong for group #217 (16416,
> counted=14898).
> Fix? no
> 
> Directories count wrong for group #217 (0,
> counted=216).
> Fix? no
> 
> Free inodes count wrong for group #218 (16416,
> counted=14878).
> Fix? no
> 
> Directories count wrong for group #218 (0,
> counted=187).
> Fix? no
> 
> Free inodes count wrong for group #219 (16416,
> counted=16033).
> Fix? no
> 
> Directories count wrong for group #219 (0,
> counted=37).
> Fix? no
> 
> Free inodes count wrong for group #220 (16416,
> counted=14949).
> Fix? no
> 
> Directories count wrong for group #220 (0,
> counted=128).
> Fix? no
> 
> Free inodes count wrong for group #221 (16416,
> counted=15167).
> Fix? no
> 
> Directories count wrong for group #221 (0,
> counted=102).
> 
=== message truncated ===



		
____________________________________________________
Sell on Yahoo! Auctions – no fees. Bid on great items.  
http://auctions.yahoo.com/