Recovering files from ext2/3

[jd1008]

On 09/18/2014 12:57 PM, Rick Stevens wrote:
> On 09/18/2014 11:45 AM, jd1008 issued this missive:
>>
>> I have been searching for ext2/3 design docs to see where the on-disk
>> superblock is located relative to starting sector of the partition, 
>> and how
>> many bytes it occucpies.
>>
>> I was also looking for the formula that is used to compute the location
>> of all of the backup superblocks.
>>
>> Thnaks for any pointers to online docs.
>
> Try "man fsck.ext3" As part of the explanation of the "-b" option:
>
> "For filesystems with 1k blocksizes, a backup superblock can be found at
> block 8193; for filesystems with 2k blocksizes, at block 16384; and for
> 4k blocksizes, at block 32768."
>
> Note that there are multiple alternate superblocks. For a 2K blocksize,
> alternate superblocks should be available at 16384, 32768, 65536, etc.
> (powers of 2). The best bet is to look at the output of mke2fs when the
> filesystem was created (you do save that stuff, don't you?). If not and
> you know the block size that was used, you can:
>
>     mke2fs -n -b <blocksize>
>
> That will cause mke2fs to simulate making a filesystem based on that
> blocksize. The "-n" means "don't actually make a filesystem, just
> display what WOULD happen", so you'd get a list of where the alternate
> superblocks would be located.
>
>> On 09/18/2014 11:37 AM, jd1008 wrote:
>>> Is there any other tool that can extract files from a partition that
>>> seems to have corrupted superblocks?
>>> I tried dumpe2fs, and fsck -b <blockNumber>
>>> to no avail. Tried all available block numbers that are listed
>>> when original mkfs was done, and it's output was saved.
>>>
>>> None of the blocks seem to work - all of them have invalid magic.
>>>
>>> When I run strings on the partition, I see many
>>> readily recognizable strings of files that I stored there.
>>>
>>> I understand that possibly the fs might be irretrievably corrupted,
>>> but wanted a last ditch input from other fs gurus.

How many bytes (or 512 byte sectors) does the superblock begin from the
start of the partition, taking into account the different block sizes 
that are
used by mkfs (i.e. 1024, 2048, 4096)?

Thanx.