release 0.0.8, which adds support for large filesystems and automatic superblock search (thanks to Ondrej Jombik), and fixes some bugs.
all users, who experienced problems with the last release (segfaults etc.) should upgrade, try again and report either success or failure to www@terminus.sk.

README file from the current release:

e2salvage, (c) 2000,2001	Marek Zelem ,
				Milan Pikula 

!!! Note that this is a free software and authors hold NO RESPONSIBILITY   !!!
!!! for any damage or loss, direct or indirect, caused by using this       !!!
!!! software. Instead, we assure you this software WILL do something nasty !!!
!!! to your partition or hard drive. Use it only on your OWN RISK and      !!!
!!! AFTER carefully reading this documentation.                            !!!

Contents
~~~~~~~~
	About
	Installation
	Guidelines for data rescuing
	How does e2salvage work
	Etc.

About
~~~~~

e2salvage is a utility, which tries to recover a data from damaged
ext2 partition. There are few differencies between e2salvage and fsck:

	* e2salvage, unlike e2fsck, does not look for the data at particular
	  places of hard-drive. It even don't tend to believe the data it
	  finds. Thus it can handle _MUCH_ more damaged filesystem. It finds
	  the metadata (i-nodes and directories) anywhere on the disk,
	  using several techniques, fixes their content and moves them at
	  the right place.

	* disks, repaired by e2salvage, are not intended to be mounted
	  read/write. You are expected to mount them r/o, copy as much data
	  as possible and re-create the filesystem by mke2fs.

	* fsck connects the found i-nodes to lost+found directory. e2salvage,
	  instead, tries to recover the directory structure.

Installation
~~~~~~~~~~~~
	Unpack the sources, compile, optionally install.

	1. zcat e2salvage.tar.gz | tar xf -
	2. cd e2salvage
	3. ./configure
	4. EDIT src/config.h - to set up some parameters for the heuristic.
	   Later this might be the done as a configuration option.

	make

	make install

Guidelines for data rescuing
~~~~~~~~~~~~~~~~~~~~~~~~~~~~

	0. all of this presumes the partition is not mountable. If you are
	   able to mount it, just copy the data somewhere else and you're
	   done.

	1. if you encounter some HARDWARE problem (disk was dropped from the
	   window, etc.), and if your data is really important to you,
	   switch the hard-drive off and call someone, who repairs physical
	   disks. DO NOT try to use the disk repairing software, be it this
	   package, e2fsck or anything else. And remember not to give your
	   disk into hands of some young techie, who thinks turning the disk
	   on is a good idea. If you are sure you have a software problem,
	   or you want to try the software solution anyway, follow the next
	   steps.

	2. it's always a good idea to back-up your partition before trying
	   something such invasive as data repair tools. On Linux, you
	   can use the command
		dd if= of= bs=512 conv=noerror,sync,notrunc
	   where  is the partition you want to salvage,
	   something like /dev/hda2, and  is the file on another
	   physical disk (preferred in most cases), or on another partition.

	   quick tip: try to mount this file using loopback device:
		mount -o loop,ro  /mnt
	   sometimes just copying the partition to file helps, because in
	   that file there are not read errors on wrong disk blocks.

	3. try fsck on the file (or on the copy of the file) first. It might
	   work:
		e2fsck -f 
	   (and, of course, try to mount the file like in step 2)

	4. it the above failed, it's time to try e2salvage. Do it on a FRESH
	   copy of partition (not on the copy you've fsck-ed right now).
		e2salvage 
	  	mount -o loop,ro  /mnt
	  note the "ro" option. Now you can copy the data from the partition,
	  and format the partition again. Voila, you're done.

	5. I have a bad news for you: if you read this, the above steps
	   were probably unsuccessful. But there is still something you can
	   do. If you seek for the text documents, just look them out on the
	   disk, using
		strings -a   >  
	   where  is the copy of your partition and  is a
	   temporary file for results. Examine the file2, for example by
		less 
	   and cut&paste the data you are interested in to another file.

	6. your data is lost forever.

How does e2salvage work
~~~~~~~~~~~~~~~~~~~~~~~
	The time interval between the time when the filesystem damage occurs
to the time you notice it (or the system crashes) is relatively short. This
means the most of your data is still untouched. Most likely to be destroyed
are the parts of a filesystem, which are mostly used: superblock, i-node
tables and root directory. When the root directory does not exist, fsck gives
up and places everything from the drive to lost+found, which is kind of
funny. Thus, the most important thing when re-creating the filesystem is not
to seek for a data, but to find or create a metadata needed to browse the
filesystem in a comfortable manner.

	The e2salvage searches the filesystem for i-nodes, given some
assumptions about what the i-node can be from src/config.h and few
hard-wired ones. It searches it for the directories too.
After this lookup, it examines the data and modifies the inode table and
directory tree. The above steps are repeated as much times as needed. This
ensures the metadata is "correct" and you can see something like files and
directories, some of them hopefully correct.

	About the details on the work, check the sources. I'll mention some
things here, but this is not necessarily true. The directories and i-nodes are
associated using "." reference in the first part of a directory. The next
parts are found by believing the i-node data, by ".." references in the
subdirectories, if any, and by blind guess from directory entries, which
cross block boundaries (if it is possible on a ext2 filesystem;). The
root i-node is re-created, if necessarry. The gross algorithm is:

1. analysis:
	* find superblock and group header
	* find root directory data
	* find inodes
	* find directories
2. collecting:
	* put the directories together by "." and ".."
3. implementation ;)
	* fill the bitmaps to "full disk"
	* create the root dir inode, if none found
	* put i-nodes at their places; put directories at places from i-nodes
	* let other directories be where they are and make i-nodes for them.
	* delete other i-nodes (to prevent filesystem crash)

Etc.
~~~~
	Smart guys never delete the "lost+found" directory. When the
fs repair tools need a safe place to store a directory data, they will
really appreciate your wisdom.

	We hope this software will work for you, like it worked for us (yeah,
it really worked:). We'd like to have some feedback from you about
functionality, scary things you encounter, anything. Best wishes,

		Marek Zelem 
	and	Milan Pikula .

To-do list:

* possibility to interrupt it before any WRITING phase
* i-nodes without dirs to lost+found
* what about devices and such crap? noone really needs them, but..
* if there are two beginning directory blocks, for the same i-node
  take the one which contains more data ~ the sum of the block is higher ;-)
* documentation, translation, ...

Links: