Date: 28 Oct 1997 13:43:28 +0000 From: Paul Richards <p.richards@elsevier.co.uk> To: questions@freebsd.org Cc: current@freebsd.org Subject: Retrieving data from a totally hosed filesystem Message-ID: <57pvoqypdr.fsf@tees.elsevier.co.uk>
next in thread | raw e-mail | index | archive | help
This is Cc'd to current since I think there's a problem with fsck (see below). I totally trashed a partition on my hard disk a week ago ( I was playing with bootblocks and scsi adapter setttings!) and I'd like to try and retrieve data from, not critical but I'm curious how to go about it since it's happened. Somehow I trashed the disklabel on the FreeBSD partition but by using a combination of guesswork and memory I rebuilt one and most of my partitions re-appeared without problem. One however didn't. fsck said the superblock was invalid so, casting caution to the wind I told fsck to use an alternate. Many coredumps of fsck later (I had to delete some inodes using fsdb in order to get fsck to complete stage1) I had a totally unravelled filesystem. fsck then tried to put all these files into lost+found but aborted because it ran out of space in lost+found (which is why I've cc'd this to current). So, now I'm curious about two things 1) fsck claims it will auto-expand lost+found if it needs to. This seems to be very broken since it doesn't. I'm not sure the strategy of building lost+found on the fly is a good one since there was no space on this partition and it doesn't look like fsck is able to to get enough space for the directory information. That might not actually be the problem since the corruption is quite serious but the lost+found directory has been created and fsck does start to place files in it so I'm suspicious that this is the problem (i.e. not able to get find enough space). Either lost+found should be pre-allocated as it used to be or we should find a way of getting fsck to build lost+found somewhere else. I started hacking fsck to try and do this but didn't get very far with it, the basic idea of changing the lost+found directory path didn't seem to work. 2) Has anyone got any bright ideas as to how I can salvage as much of the data from this partition as is possible. Since the actual data is not corrupted (a dd of the partition shows all the data is still untouched) there might be a way to extract the data from the partition and reconstruct a filesystem in another area of the disk. Seems like an interesting challenge to me and I was wondering if anyone had any tools as a starting point. If nothing else, I suspect it should be possible to get the unlinked inodes connected to a directory as fsck should have done in lost+found and at least retrieve the data in those files. -- Dr Paul Richards. IT, Product Application Development. Email: p.richards@elsevier.co.uk Phone: x3155
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?57pvoqypdr.fsf>