Filesystem directory structure recovery - competition for Beer of the Month Club

Paul English penglish at hydro.washington.edu
Mon May 12 15:32:49 PDT 2003


Hi Everyone,
	At Chuck's suggestion I'm opening up a competition for a 6 month
subscription to Beer of the Month club.

The Judge:
	That's me. A reasonably competent sysadmin.

The Goal:
	Be the first one to send me the most helpful information on how to
recover the directory structure of a messed-up filesystem.


The Parameters:
	I had a disk failure. Unfortunately, I also discovered that my
backup server (Legato Networker under Solaris) had run out of licenses.
And tried to email me, but failed to inform me on the Networker screen
that I keep open at all times. (I'm not bitter!) And I also discovered the
email delivery wasn't working properly on that machine. So - I have no backups
of this system.

	I sent my disk to a data recovery company. They were able to
recover "all but 2%" of the data, but they did it in a raw mode and copied
it to a new disk and sent that to me. I promptly copied that to yet
another disk (using dd) so that I wouldn't mess up what I paid them so
much money for. They're still trying to recover the directory structure
for me, and if they beat you all the competition is off since they won't
be giving me a refund!

	I am only interested in one separate partition on this disk with
my user's data on it. So I tried to mount that partition, only to find
that the superblock was bad. I used newfs -N to find out where the backup
superblocks were, and found one (several actually) that were fine. Using
fsck -b to restore it, then fsck wants to make LOTS of changes.

If I say "yes" to everything, *all* of the data on the disk (15GB) ends
up in lost+found. Some of the directory structure is preserved, but there 145
inode-numbered directories in the top level.

If I say "no" to everything (except replacement of the bad superblock), I
can mount it read-only (or rw with -f), but there is nothing there when I
do an ls:
#ls /mnt
> ls: /mnt: Bad file descriptor

	I have not tried doing a mixture of yes's and no's to fsck's
questions, since it asks a *lot* of questions about this filesystem, and I
don't know which ones to say yes or no to in any case. That would be
useful information.

	I would like to hand my user back his directory with all of those
145 inode-numbered directories in their proper places in the filesystem
with their proper names. Without the names, places would still be helpful
and vice versa.


Paul



More information about the freebsd-questions mailing list