[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: "Guessing" superblock parameters

Sander Steffann schrieb:

Is the filesystem (offset of inode tables, ...) the same everytime I
format the same partition? If not, why?
Yes, this is generally true for a given blocksize. Even the journal is created after the inode tables are allocated. However, as part of the mke2fs the inode tables are zeroed, so this would in fact be bad in your case.

You can use the -n option:

       -n     causes mke2fs to not actually create a filesystem, but
              what  it  would do if it were to create a filesystem.  This
              be used to determine the location of the backup superblocks
              a  particular filesystem, so long as the mke2fs parameters
              were passed when the filesystem was originally created are
              again.  (With the -n option added, of course!)

Thank you for this information! I did it. But I found one strange thing: On a few block groups, there were at first the superblock and group descriptor (opt.) and then the two bitmaps. But after that, there was extactly one data block. In one such block e.g. there was an exe file.
And AFTER this one data block the inodes followed (all zeroed out).
In the data block bitmap the first byte was 0xff.

Why that?

I modified e2salvage again to save only the inodes that COULD be part of the inode table, i.e. the block had to be between block_group_beginning and block_group_beginning+inode_blocks+10.
And I exactly found 2 inodes instead of 80000 :-(
The two inodes are probably lost+found and the root directory of the reformatted file system. However, the the 80000 I've found before seem to belong to the file system images I had on that partition :-(

So it's clear now: Continue playing puzzle :-(

Thank you for your help!


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]