[ ChangeLog | Download .tar.gz | Browse the source ]

e2salvage has moved!

The project has moved to http://e2salvage.sourceforge.net/. This is the previous web page, which will no longer be maintained.

This is a utility, which can help you rescuing your lost ext2 partition. Other utilities include fsck, which is able to repair some damage, and gpart, which repairs partition tables.

If you are here, you probably lost your filesystem and want to run any tool right *now* to get the data back. But the first rule in such cases is: calm down! and make a backup image of the whole disk to another one before running any such utilities. Running improper tool (fsck when you have to start e2salvage, e2salvage when you have to start gpart, and so on) usually does additional damage, which may prevent the correct utility from work.

Check the README file carefully, as there is a step-by-step tutorial which will help you start. If in trouble, sending an e-mail might help :).


  • Mon Nov 25 16:23:06 CET 2002:

    README file from the current release:

    e2salvage, (c) 2000,2001	Marek Zelem ,
    				Milan Pikula 
    !!! Note that this is a free software and authors hold NO RESPONSIBILITY   !!!
    !!! for any damage or loss, direct or indirect, caused by using this       !!!
    !!! software. Instead, we assure you this software WILL do something nasty !!!
    !!! to your partition or hard drive. Use it only on your OWN RISK and      !!!
    !!! AFTER carefully reading this documentation.                            !!!
    	Guidelines for data rescuing
    	How does e2salvage work
    e2salvage is a utility, which tries to recover a data from damaged
    ext2 partition. There are few differencies between e2salvage and fsck:
    	* e2salvage, unlike e2fsck, does not look for the data at particular
    	  places of hard-drive. It even don't tend to believe the data it
    	  finds. Thus it can handle _MUCH_ more damaged filesystem. It finds
    	  the metadata (i-nodes and directories) anywhere on the disk,
    	  using several techniques, fixes their content and moves them at
    	  the right place.
    	* disks, repaired by e2salvage, are not intended to be mounted
    	  read/write. You are expected to mount them r/o, copy as much data
    	  as possible and re-create the filesystem by mke2fs.
    	* fsck connects the found i-nodes to lost+found directory. e2salvage,
    	  instead, tries to recover the directory structure.
    	Unpack the sources, compile, optionally install.
    	1. zcat e2salvage.tar.gz | tar xf -
    	2. cd e2salvage
    	3. ./configure
    	4. EDIT src/config.h - to set up some parameters for the heuristic.
    	   Later this might be the done as a configuration option.
    	make install
    Guidelines for data rescuing
    	0. all of this presumes the partition is not mountable. If you are
    	   able to mount it, just copy the data somewhere else and you're
    	1. if you encounter some HARDWARE problem (disk was dropped from the
    	   window, etc.), and if your data is really important to you,
    	   switch the hard-drive off and call someone, who repairs physical
    	   disks. DO NOT try to use the disk repairing software, be it this
    	   package, e2fsck or anything else. And remember not to give your
    	   disk into hands of some young techie, who thinks turning the disk
    	   on is a good idea. If you are sure you have a software problem,
    	   or you want to try the software solution anyway, follow the next
    	2. it's always a good idea to back-up your partition before trying
    	   something such invasive as data repair tools. On Linux, you
    	   can use the command
    		dd if= of= bs=512 conv=noerror,sync,notrunc
    	   where  is the partition you want to salvage,
    	   something like /dev/hda2, and  is the file on another
    	   physical disk (preferred in most cases), or on another partition.
    	   quick tip: try to mount this file using loopback device:
    		mount -o loop,ro  /mnt
    	   sometimes just copying the partition to file helps, because in
    	   that file there are not read errors on wrong disk blocks.
    	3. try fsck on the file (or on the copy of the file) first. It might
    		e2fsck -f 
    	   (and, of course, try to mount the file like in step 2)
    	4. it the above failed, it's time to try e2salvage. Do it on a FRESH
    	   copy of partition (not on the copy you've fsck-ed right now).
    	  	mount -o loop,ro  /mnt
    	  note the "ro" option. Now you can copy the data from the partition,
    	  and format the partition again. Voila, you're done.
    	5. I have a bad news for you: if you read this, the above steps
    	   were probably unsuccessful. But there is still something you can
    	   do. If you seek for the text documents, just look them out on the
    	   disk, using
    		strings -a   >  
    	   where  is the copy of your partition and  is a
    	   temporary file for results. Examine the file2, for example by
    	   and cut&paste the data you are interested in to another file.
    	6. your data is lost forever.
    How does e2salvage work
    	The time interval between the time when the filesystem damage occurs
    to the time you notice it (or the system crashes) is relatively short. This
    means the most of your data is still untouched. Most likely to be destroyed
    are the parts of a filesystem, which are mostly used: superblock, i-node
    tables and root directory. When the root directory does not exist, fsck gives
    up and places everything from the drive to lost+found, which is kind of
    funny. Thus, the most important thing when re-creating the filesystem is not
    to seek for a data, but to find or create a metadata needed to browse the
    filesystem in a comfortable manner.
    	The e2salvage searches the filesystem for i-nodes, given some
    assumptions about what the i-node can be from src/config.h and few
    hard-wired ones. It searches it for the directories too.
    After this lookup, it examines the data and modifies the inode table and
    directory tree. The above steps are repeated as much times as needed. This
    ensures the metadata is "correct" and you can see something like files and
    directories, some of them hopefully correct.
    	About the details on the work, check the sources. I'll mention some
    things here, but this is not necessarily true. The directories and i-nodes are
    associated using "." reference in the first part of a directory. The next
    parts are found by believing the i-node data, by ".." references in the
    subdirectories, if any, and by blind guess from directory entries, which
    cross block boundaries (if it is possible on a ext2 filesystem;). The
    root i-node is re-created, if necessarry. The gross algorithm is:
    1. analysis:
    	* find superblock and group header
    	* find root directory data
    	* find inodes
    	* find directories
    2. collecting:
    	* put the directories together by "." and ".."
    3. implementation ;)
    	* fill the bitmaps to "full disk"
    	* create the root dir inode, if none found
    	* put i-nodes at their places; put directories at places from i-nodes
    	* let other directories be where they are and make i-nodes for them.
    	* delete other i-nodes (to prevent filesystem crash)
    	Smart guys never delete the "lost+found" directory. When the
    fs repair tools need a safe place to store a directory data, they will
    really appreciate your wisdom.
    	We hope this software will work for you, like it worked for us (yeah,
    it really worked:). We'd like to have some feedback from you about
    functionality, scary things you encounter, anything. Best wishes,
    		Marek Zelem 
    	and	Milan Pikula .

    To-do list:

    * possibility to interrupt it before any WRITING phase
    * i-nodes without dirs to lost+found
    * what about devices and such crap? noone really needs them, but..
    * if there are two beginning directory blocks, for the same i-node
      take the one which contains more data ~ the sum of the block is higher ;-)
    * documentation, translation, ...


  • none yet...