Best Practices for Data Recovery for corrupted EXT2/3?

[Theodore Tso]

On Tue, Nov 28, 2006 at 10:58:09AM -0600, Thomas Weeks wrote:
> 
> I had a bad IDE controller that hosed my EXT3 filesystems.  A resulting fsck 
> damaged pat of the filesystem and the root inode is gone (on my main drive 
> AND the backup drive).   I immediately DD'd the main drive over to an 
> identical drive that I have been working on.  But every time.. a fsck 
> destroys all the data (moves everything to lost+found) and nothing that I've 
> found is able to restore the dir structure... or allow me to superposition 
> any of the subdirs (such as /home/*).

Unfortunately, if the root inode is gone, you've lost the names of the
inodes in the root directory.  Usually though most of the inodes in
the root directory are directories, and so the directory hierarchy is
moved to lost+found.  So if you see a directory /lost+found/#5612 that
has files such as /lost+found/#5612/passwd and /lost+found/#5612/motd,
then you could probably guess that #5612 was /etc, and you could then
just move /lost+found/#5612 to /etc.  

Of course, if more of the filesystem than just the root directory is
gone, then you may have lost more directory information and so things
might be not be quite that simple to recover from.

> I would like to retain file names.. as I see that SOME filename/dir structure 
> is intact when the fsck starts nuking all my files that don't have a parent 
> dir (e.g. ../home/user/file1 --> lost+found).  Is there a way that this 
> information can be salvaged?  Or a new fake root inode be slid into place and 
> all the links associated?

It's not that fsck is nuking the names --- the names were gone from
your hardware corruption.  Fsck is seeing that inode doesn't have a
name, which is why it is moving it to /lost+found so you at least
don't lose the data.  Please don't blame fsck; it's doing the best job
that it can!

> My last ditch effort will be to allow the migration to lost+found and then try 
> to copy off files based on UID/GID/date, but I would really like to retain 
> file names. 

Sorry, the file names are gone; if they were there, fsck would have
used them.  If you have a valid locatedb database, you might be able
to use that to help reconstruct the filenames, and of course as a
responsible sysadmin you have been doing regular backups (RIGHT? :-),
so you could use that information as well.

Regards and good luck,

						- Ted