Recovering files from ext2/3

[jd1008]

On 09/21/2014 08:58 AM, Robert Nichols wrote:
> On 09/20/2014 10:50 PM, jd1008 wrote:
>>
>> On 09/20/2014 09:41 PM, Robert Nichols wrote:
>>> On 09/20/2014 08:30 PM, jd1008 wrote:
>>>> / posted it to the ext3 maling list (turns out they also know ext4)
>>>> and they admitted about undocumented effects of using the -S
>>>> option, and that one must NEVER use it unless they know the intrinsics
>>>> of the FS so well, that the user knows exactly what effects it will
>>>> have.
>>>
>>> Sounds like a pretty useless option, then, and that sort of exchange is
>>> exactly the sort of thing I don't want to get involved in.
>>>
>>> Digging down into my hack stack, the next thing I would try is to make
>>> a sparse file of exactly the same size as your partition (you can use
>>> the /truncate/ command to do that), then run /mkfs.ext3/ on that file
>>> and copy the resulting super block, which is the 2nd 1K block in the
>>> file, to your broken filesystem.  Then you could see whether /debugfs/
>>> can make any sense of that filesystem and what /fsck/ might try to do
>>> to restore it.  The first time through, just answer "n" to anything
>>> /fsck/ wants to fix and just get a feeling for the extent of the 
>>> damage.
>>>
>> Good suggestion!!
>> I will try it and report back.
>
> I did some further investigation, and now I see what is happening.
> If your version of /mke3fs/ is not the same one that created the
> filesystem, or if the FS has been resized or had other structural
> changes, then the new one will likely be created with slightly
> different parameters (number of inodes, number of inodes per group,
> number of blocks reserved for GDT expansion, etc.).  That puts all
> of the internal structures in slightly different locations, so
> "mke3fs -S" just results in a mess that is worse than before.
>
> Unfortunately, my suggestion about patching in a new super block
> succumbs to the same fate.
>
> Unless you can use the same version of e2fsprogs that originally
> built the FS, and that FS has not been restructured since creation,
> I fear you are reduced to using /photorec/ to try to recover files.
>
Yes, I can use original ubuntu 12.04 live dvd to do that. That
was the version used to create the partitions ... etc.