fsck salvaging directory structure

[Paul English]

On Sat, 10 May 2003, Chuck Swiger wrote:

> Paul English wrote:
> [ ... ]
> > 	It wants to have fsck run - if I do that with fsck -y it will
> > clean the filesystem, and mount, but *everything* (all 15GB) is in
> > lost+found.
>
> fsck should be able to salvage some of the existing directory structure
> under /lost+found; are you getting a single directory full of
> inode-#-named files without any subdirectories?

I should have been more accurate - there are subdirectories. What I get
are 145 inode-#-named files with subdirectories under some of them.

>  > If I just restore the superblock with fsck, and don't do
> > anything else, then I can mount the filesystem readonly, but then when I
> > mount it there is nothing there:
>  >
> > #ls /mnt
> > ls: /mnt: Bad file descriptor
>
> What happened to the original disk?  This sounds like the / directory
> got wiped, along with the first superblock...was the disk partially erased?

The original disk had a head crash. I sent it to a data recovery company
who recovered "all but 2% of the data" and sent me back a new disk with an
image of the old one on it. All this is in trying to mount the new
disk. Actaully I imaged it onto yet another disk so that I wouldn't loose
what they sent me, but it was the same when I tried to mount what they
sent me.

> > What else can I try? Pulling 15GB of data from lost+found is pretty
> > impractical.
>
> What are you trying to accomplish?

What I'd like is to restore the filesystem just as it was, but more simply
the user who owns the data needs to have access to his data in a usable
way. At the moment he has to sift through 145 unlinked files which is
pretty bad.

> What you might want to do depends on whether you want to simply identify
> your files from OS files (timestamps, if still meaningful could help
> here), how important recovering the directory structure is, etc.

In this case, it is a separate partition from all the OS files, which I'm
not even bothering with, so that narrows down the problem some.

> If you knew that the first XXX MB of the disk had been wiped, you might
> try installing the same version of FreeBSD you were running to a new
> filesystem of the same size and layout-- be sure to specify a 8K/1K
> block/frag size versus 16K/2K if that's what you had.  And then copy
> that chunk of data over the zero'd portion of your recovered data, and
> see whether that helps.
>
> Or you could then perform an md5 hash of every file found on a clean
> install, and md5 all of the recovered files under /lost+found, and only
> pay attention to recovered files which don't have a checksum that matches.

I have to admit that I'm not clear how the first one would help, but you
didn't know that I'd already managed to copy this to a disk and get it
recognized as a valid partition.

The second one is definitely good for filtering out the OS files, but
fortunatley that part I don't have to worry about.

> PS: Given the state of employment in the tech industry, you might find
> that offering, say, a 6-month subscription to a "beer of the month club"
> to the person who helps you out the most would have astonishing results.

Sounds like a plan - it isn't even that much compared to what I'm dropping
on the data recovery company (although they are going to refund me if they
can't do any better than this). I'll be a little more specific than "the
most help" though. :-)

Thanks to you - so far you have helped me narrow down and specify my
question a great deal!


Paul