Salvage or undelete files of damaged ext2/ext3 file systems

[Keld Jørn Simonsen]

Hi!

I have made some extensions to debugfs to undelete or recover files
from a damaged ext3 file system.

Salvage or undelete files of damaged ext2/ext3 file systems
debugfs salvage command can be used to salvage files from a damaged ext3
or ext2 file system. The code is alpha, so use at your own risk.

the usage is:

salvage first-block count-blocks

Salvage tries to salvage files found in blocks starting from first-block
and then totally count-block blocks. if count-blocks is 0, or greater
than the number of blocks in the file system, it is set to the number of
blocks in the fs.

typical use:

cd directory-to-hold-salvaged-files
path/debugfs /dev/damaged-file-system
salvage 1 0

salvage could be useful if you have accidently remoded a lot of files in
a ext2/ext3 file system like with a "rm -rf /" command, or if you
accidently reformatted the file system via an mkfs/mke2fs command, or if
your harddisk had severe hardware problems. The filenames will be "ix1-"
or "ix2-" followed by the block number of the indirect or double
indirect block number that defined the main part of the file. In this
way salvage may be used to repair, rescue, recover or undelete files.

If a file already exists in the current directory, and is not writable,
salvage will skip writing it. This can be used to skip writing of big
files.

less can be used to inspect the files. newer versions of less can detect
various file formats, such as gzip, bzip2, tar etc., and display
something meaningful.

method: Salvage goes thru all the blocks in the fs, and checks whether
this could be indirect or double indirect blocks. If so, it tries to
recreate the file in the current directory. There is then involved some
guessing about what indirect block is corresponding to a double indirect
block, and what initial data blocks are corresponding to an indirect
block. The guessing, and the fact that some blocks may have been reused
unfortunately means that there may be errors in the salvaged files. So
check them afterwards.

The code is alpha and has only been tested on a Linux i386 system

Salvage is an addition to the debugfs program in the e2progs package by
Ted Ts'o.

Download: http://www.dkuug.dk/keld/e2fsprogs-1.38-ks1.tar.gz. Then
follow INSTALL instructions.

Author: Keld Simonsen, keld at dkuug.dk