e2salvage, (c) 2000,2001 Marek Zelem , Milan Pikula !!! Note that this is a free software and authors hold NO RESPONSIBILITY !!! !!! for any damage or loss, direct or indirect, caused by using this !!! !!! software. Instead, we assure you this software WILL do something nasty !!! !!! to your partition or hard drive. Use it only on your OWN RISK and !!! !!! AFTER carefully reading this documentation. !!! Contents ~~~~~~~~ About Installation Guidelines for data rescuing How does e2salvage work Etc. About ~~~~~ e2salvage is a utility, which tries to recover a data from damaged ext2 partition. There are few differencies between e2salvage and fsck: * e2salvage, unlike e2fsck, does not look for the data at particular places of hard-drive. It even don't tend to believe the data it finds. Thus it can handle _MUCH_ more damaged filesystem. It finds the metadata (i-nodes and directories) anywhere on the disk, using several techniques, fixes their content and moves them at the right place. * disks, repaired by e2salvage, are not intended to be mounted read/write. You are expected to mount them r/o, copy as much data as possible and re-create the filesystem by mke2fs. * fsck connects the found i-nodes to lost+found directory. e2salvage, instead, tries to recover the directory structure. Installation ~~~~~~~~~~~~ Unpack the sources, compile, optionally install. 1. zcat e2salvage.tar.gz | tar xf - 2. cd e2salvage 3. ./configure 4. EDIT src/config.h - to set up some parameters for the heuristic. Later this might be the done as a configuration option. make make install Guidelines for data rescuing ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 0. all of this presumes the partition is not mountable. If you are able to mount it, just copy the data somewhere else and you're done. 1. if you encounter some HARDWARE problem (disk was dropped from the window, etc.), and if your data is really important to you, switch the hard-drive off and call someone, who repairs physical disks. DO NOT try to use the disk repairing software, be it this package, e2fsck or anything else. And remember not to give your disk into hands of some young techie, who thinks turning the disk on is a good idea. If you are sure you have a software problem, or you want to try the software solution anyway, follow the next steps. 2. it's always a good idea to back-up your partition before trying something such invasive as data repair tools. On Linux, you can use the command dd if= of= bs=512 conv=noerror,sync,notrunc where is the partition you want to salvage, something like /dev/hda2, and is the file on another physical disk (preferred in most cases), or on another partition. quick tip: try to mount this file using loopback device: mount -o loop,ro /mnt sometimes just copying the partition to file helps, because in that file there are not read errors on wrong disk blocks. 3. try fsck on the file (or on the copy of the file) first. It might work: e2fsck -f (and, of course, try to mount the file like in step 2) 4. it the above failed, it's time to try e2salvage. Do it on a FRESH copy of partition (not on the copy you've fsck-ed right now). e2salvage mount -o loop,ro /mnt note the "ro" option. Now you can copy the data from the partition, and format the partition again. Voila, you're done. 5. I have a bad news for you: if you read this, the above steps were probably unsuccessful. But there is still something you can do. If you seek for the text documents, just look them out on the disk, using strings -a > where is the copy of your partition and is a temporary file for results. Examine the file2, for example by less and cut&paste the data you are interested in to another file. 6. your data is lost forever. How does e2salvage work ~~~~~~~~~~~~~~~~~~~~~~~ The time interval between the time when the filesystem damage occurs to the time you notice it (or the system crashes) is relatively short. This means the most of your data is still untouched. Most likely to be destroyed are the parts of a filesystem, which are mostly used: superblock, i-node tables and root directory. When the root directory does not exist, fsck gives up and places everything from the drive to lost+found, which is kind of funny. Thus, the most important thing when re-creating the filesystem is not to seek for a data, but to find or create a metadata needed to browse the filesystem in a comfortable manner. The e2salvage searches the filesystem for i-nodes, given some assumptions about what the i-node can be from src/config.h and few hard-wired ones. It searches it for the directories too. After this lookup, it examines the data and modifies the inode table and directory tree. The above steps are repeated as much times as needed. This ensures the metadata is "correct" and you can see something like files and directories, some of them hopefully correct. About the details on the work, check the sources. I'll mention some things here, but this is not necessarily true. The directories and i-nodes are associated using "." reference in the first part of a directory. The next parts are found by believing the i-node data, by ".." references in the subdirectories, if any, and by blind guess from directory entries, which cross block boundaries (if it is possible on a ext2 filesystem;). The root i-node is re-created, if necessarry. The gross algorithm is: 1. analysis: * find superblock and group header * find root directory data * find inodes * find directories 2. collecting: * put the directories together by "." and ".." 3. implementation ;) * fill the bitmaps to "full disk" * create the root dir inode, if none found * put i-nodes at their places; put directories at places from i-nodes * let other directories be where they are and make i-nodes for them. * delete other i-nodes (to prevent filesystem crash) Etc. ~~~~ Smart guys never delete the "lost+found" directory. When the fs repair tools need a safe place to store a directory data, they will really appreciate your wisdom. We hope this software will work for you, like it worked for us (yeah, it really worked:). We'd like to have some feedback from you about functionality, scary things you encounter, anything. Best wishes, Marek Zelem and Milan Pikula .