Hello
On Wed, 2005-02-09 at 01:21, Christian Placzek wrote:
> Hello,
>
> a friend of mine shredded his data (70GB) when he tried to undelete an
> accidentally deleted file. He normally works with windoze. Therefore he
> didn't know he couldn't undelete a file on a reiserfs partition with ext2
> undelete tool %-(
> When he called me it was already too late. He had overwritten the
> superblock :-(
>
> I'm still trying to rescue the data. I can see them in the image using grep
> or hexedit. But nothing I tried has been successful. My first steps were
> unmounting the partition, taking an image and working with a copy of this
> image using a loop back device.
>
> All files have been retrieved but were removed by reiserfsck --check although
> the last output says that directories and files have been linked (see below).
> I tried with many combinations nearly all parameters of reiserfsck:
> --fix-fixable --no-journal-available -S ...
>
have you tried
reiserfsck --rebuild-tree -S
?
If not, run it on newly created copy of shredded device.
Did you look at lost+found?
>
> I mounted the image after each operation, but all I can see is:
>
> [EMAIL PROTECTED]:/home/kris 0$ # mount -o ro /dev/loop/0 /mnt/temp1/
> [EMAIL PROTECTED]:/home/kris 0$ # ls -la /mnt/temp1/
> total 21
> drwxr-xr-x 3 root root 4096 Jan 20 11:36 .
> drwxr-xr-x 39 root root 968 Feb 6 14:12 ..
> drwx------ 2 root root 16384 Jan 20 11:36 lost+found
> [EMAIL PROTECTED]:/home/kris 0$ # ls -la /mnt/temp1/lost+found/
> total 20
> drwx------ 2 root root 16384 Jan 20 11:36 .
> drwxr-xr-x 3 root root 4096 Jan 20 11:36 ..
> [EMAIL PROTECTED]:/home/kris 0$ #
>
>
> Do you have any suggestions how to rescue the data?
>
> Regards
> Kris
>
>
>
> Here you see a typical output:
>
> [EMAIL PROTECTED]:/home/kris 0$ # losetup /dev/loop/0 /mnt/temp/data.x.dd
> [EMAIL PROTECTED]:/home/kris 0$ # reiserfsck /dev/loop/0 --rebuild-tree
> reiserfsck 3.6.19 (2003 www.namesys.com)
>
> <snip>
>
> Will rebuild the filesystem (/dev/loop/0) tree
> Will put log info to 'stdout'
>
> Do you want to run this program?[N/Yes] (note need to type Yes if you do):Yes
>
> reiserfs_open: the reiserfs superblock cannot be found on /dev/loop/0.
> Failed to open the filesystem.
>
> If the partition table has not been changed, and the partition is
> valid and it really contains a reiserfs partition, then the
> superblock is corrupted and you need to run this utility with
> --rebuild-sb.
>
> [EMAIL PROTECTED]:/home/kris 8$ # reiserfsck /dev/loop/0 --rebuild-sb
> reiserfsck 3.6.19 (2003 www.namesys.com)
>
> <snip>
>
> Will check superblock and rebuild it if needed
> Will put log info to 'stdout'
>
> reiserfs_open: the reiserfs superblock cannot be found on /dev/loop/0.
>
> what the version of ReiserFS do you use[1-4]
> (1) 3.6.x
> (2) >=3.5.9 (introduced in the middle of 1999) (if you use linux 2.2,
> choose this one)
> (3) < 3.5.9 converted to new format (don't choose if unsure)
> (4) < 3.5.9 (this is very old format, don't choose if unsure)
> (X) exit
> 1
>
> Enter block size [4096]:
>
>
> No journal device was specified. (If journal is not available, re-run with
> --no-journal-available option specified).
> Is journal default? (y/n)[y]:
>
> Did you use resizer(y/n)[n]:
> rebuild-sb: no uuid found, a new uuid was generated
> (7e253707-4fef-42aa-9785-b1cd079851af)
>
> rebuild-sb: You either have a corrupted journal or have just changed
> the start of the partition with some partition table editor. If you are
> sure that the start of the partition is ok, rebuild the journal header.
> Do you want to rebuild the journal header? (y/n)[n]: y
> Reiserfs super block in block 16 on 0x700 of format 3.6 with standard journal
> Count of blocks on the device: 17659440
> Number of bitmaps: 539
> Blocksize: 4096
> Free blocks (count of blocks - used [journal, bitmaps, data, reserved]
> blocks): 0
> Root block: 0
> Filesystem is NOT clean
> Tree height: 0
> Hash function used to sort names: not set
> Objectid map size 0, max 972
> Journal parameters:
> Device [0x0]
> Magic [0x0]
> Size 8193 blocks (including 1 for journal header) (first block 18)
> Max transaction length 1024 blocks
> Max batch size 900 blocks
> Max commit age 30
> Blocks reserved by journal: 0
> Fs state field: 0x1:
> some corruptions exist.
> sb_version: 2
> inode generation number: 0
> UUID: 7e253707-4fef-42aa-9785-b1cd079851af
> LABEL:
> Set flags in SB:
> Is this ok ? (y/n)[n]: y
> The fs may still be unconsistent. Run reiserfsck --check.
>
> [EMAIL PROTECTED]:/home/kris 1$ # reiserfsck /dev/loop/0 --check
> reiserfsck 3.6.19 (2003 www.namesys.com)
>
> <snip>
>
> Will read-only check consistency of the filesystem on /dev/loop/0
> Will put log info to 'stdout'
> ###########
> reiserfsck --check started at Tue Feb 8 17:17:31 2005
> ###########
> Replaying journal..
> Reiserfs journal '/dev/loop/0' in blocks [18..8211]: 0 transactions replayed
> Zero bit found in on-disk bitmap after the last valid bit.
> Checking internal tree..
>
> Bad root block 0. (--rebuild-tree did not complete)
>
> Aborted
> [EMAIL PROTECTED]:/home/kris 134$ # reiserfsck /dev/loop/0 -y --rebuild-tree
> reiserfsck 3.6.19 (2003 www.namesys.com)
>
> <snip>
>
> Will rebuild the filesystem (/dev/loop/0) tree
> Will put log info to 'stdout'
>
> Do you want to run this program?[N/Yes] (note need to type Yes if you do):Yes
> Replaying journal..
> Reiserfs journal '/dev/loop/0' in blocks [18..8211]: 0 transactions replayed
> Zero bit found in on-disk bitmap after the last valid bit. Fixed.
> ###########
> reiserfsck --rebuild-tree started at Tue Feb 8 17:37:56 2005
> ###########
>
> Pass 0:
> ####### Pass 0 #######
> Loading on-disk bitmap .. ok, 559628 blocks marked used
> init_source_bitmap: Bitmap 0 (of 32768 bits) is wrong - mark all blocks [0 -
> 32768] as used
> init_source_bitmap: Bitmap 1 (of 32768 bits) is wrong - mark all blocks
> [32768 - 65536] as used
> init_source_bitmap: Bitmap 3 (of 32768 bits) is wrong - mark all blocks
> [98304 - 131072] as used
> init_source_bitmap: Bitmap 5 (of 32768 bits) is wrong - mark all blocks
> [163840 - 196608] as used
> init_source_bitmap: Bitmap 7 (of 32768 bits) is wrong - mark all blocks
> [229376 - 262144] as used
> init_source_bitmap: Bitmap 9 (of 32768 bits) is wrong - mark all blocks
> [294912 - 327680] as used
> init_source_bitmap: Bitmap 25 (of 32768 bits) is wrong - mark all blocks
> [819200 - 851968] as used
> init_source_bitmap: Bitmap 27 (of 32768 bits) is wrong - mark all blocks
> [884736 - 917504] as used
> init_source_bitmap: Bitmap 49 (of 32768 bits) is wrong - mark all blocks
> [1605632 - 1638400] as used
> init_source_bitmap: Bitmap 81 (of 32768 bits) is wrong - mark all blocks
> [2654208 - 2686976] as used
> init_source_bitmap: Bitmap 125 (of 32768 bits) is wrong - mark all blocks
> [4096000 - 4128768] as used
> init_source_bitmap: Bitmap 243 (of 32768 bits) is wrong - mark all blocks
> [7962624 - 7995392] as used
> init_source_bitmap: Bitmap 343 (of 32768 bits) is wrong - mark all blocks
> [11239424 - 11272192] as used
> Skipping 8749 blocks (super block, journal, bitmaps) 687599 blocks will be
> read
> 0%....20%....40%....60%....80%....100% left 0,
> 9549 /sec
> 103101 directory entries were hashed with "r5" hash.
> Selected hash ("r5") does not match to the hash set in the super block (not
> set).
> "r5" hash is selected
> Flushing..finished
> Read blocks (but not data blocks) 687599
> Leaves among those 20621
> Objectids found 114185
>
> Pass 1 (will try to insert 20621 leaves):
> ####### Pass 1 #######
> Looking for allocable blocks .. finished
> 0%....20%....40%....60%....80%....100% left 0,
> 1718 /sec
> Flushing..finished
> 20621 leaves read
> 20524 inserted
> - pointers in indirect items pointing to metadata 3
> (zeroed)
> 97 not inserted
> non-unique pointers in indirect items (zeroed) 1075
> ####### Pass 2 #######
>
> Pass 2:
> 0%....20%....40%....60%vpf-10260: The file we are inserting the new item
> (69291 69327 0x1 DRCT (2), len 216, location 3880 entry count 65535, fsck
> need 0, format new) into has no StatData, insertion was skipped
> ....vpf-10260: The file we are inserting the new item (240148 240150 0x1 IND
> (1), len 1844, location 2252 entry count 0, fsck need 0, format new) into has
> no StatData, insertion was skipped
> vpf-10260: The file we are inserting the new item (241304 319211 0x43001 IND
> (1), len 492, location 3604 entry count 0, fsck need 0, format new) into has
> no StatData, insertion was skipped
> vpf-10260: The file we are inserting the new item (737518 739813 0xe6001 IND
> (1), len 688, location 3408 entry count 0, fsck need 0, format new) into has
> no StatData, insertion was skipped
> 80%vpf-10260: The file we are inserting the new item (737518 739813 0xe6001
> IND (1), len 688, location 3408 entry count 0, fsck need 0, format new) into
> has no StatData, insertion was skipped
> vpf-10260: The file we are inserting the new item (25 93014 0x1e1 DRCT (2),
> len 1408, location 2688 entry count 65535, fsck need 0, format new) intohas
> no StatData, insertion was skipped
> vpf-10260: The file we are inserting the new item (238343 319306 0x3f4001 IND
> (1), len 136, location 3960 entry count 0, fsck need 0, format new) into has
> no StatData, insertion was skipped
> vpf-10260: The file we are inserting the new item (94077 119920 0x1 DRCT (2),
> len 456, location 3640 entry count 65535, fsck need 0, format new) into has
> no StatData, insertion was skipped
> vpf-10260: The file we are inserting the new item (102491 220397 0x179 DRCT
> (2), len 1264, location 2832 entry count 65535, fsck need 0, format new)into
> has no StatData, insertion was skipped
> .vpf-10260: The file we are inserting the new item (642448 771721 0xcc1 DRCT
> (2), len 520, location 3576 entry count 65535, fsck need 0, format new)into
> has no StatData, insertion was skipped
> .vpf-10260: The file we are inserting the new item (294390 692752 0x129 DRCT
> (2), len 296, location 3800 entry count 65535, fsck need 0, format new)into
> has no StatData, insertion was skipped
> vpf-10260: The file we are inserting the new item (294390 692752 0x129 DRCT
> (2), len 296, location 3800 entry count 65535, fsck need 0, format new) into
> has no StatData, insertion was skipped
> vpf-10260: The file we are inserting the new item (294390 692752 0x129 DRCT
> (2), len 296, location 3800 entry count 65535, fsck need 0, format new) into
> has no StatData, insertion was skipped
> .vpf-10260: The file we are inserting the new item (294390 692752 0x129 DRCT
> (2), len 296, location 3800 entry count 65535, fsck need 0, format new)into
> has no StatData, insertion was skipped
> vpf-10260: The file we are inserting the new item (294390 692752 0x129 DRCT
> (2), len 296, location 3800 entry count 65535, fsck need 0, format new) into
> has no StatData, insertion was skipped
> vpf-10260: The file we are inserting the new item (294390 692752 0x129 DRCT
> (2), len 296, location 3800 entry count 65535, fsck need 0, format new) into
> has no StatData, insertion was skipped
> vpf-10260: The file we are inserting the new item (294390 692752 0x129 DRCT
> (2), len 296, location 3800 entry count 65535, fsck need 0, format new) into
> has no StatData, insertion was skipped
> vpf-10260: The file we are inserting the new item (294390 692752 0x129 DRCT
> (2), len 296, location 3800 entry count 65535, fsck need 0, format new) into
> has no StatData, insertion was skipped
> .vpf-10260: The file we are inserting the new item (294390 692752 0x129 DRCT
> (2), len 296, location 3800 entry count 65535, fsck need 0, format new)into
> has no StatData, insertion was skipped
> vpf-10260: The file we are inserting the new item (294390 692752 0x129 DRCT
> (2), len 296, location 3800 entry count 65535, fsck need 0, format new) into
> has no StatData, insertion was skipped
> vpf-10260: The file we are inserting the new item (294390 692752 0x129 DRCT
> (2), len 296, location 3800 entry count 65535, fsck need 0, format new) into
> has no StatData, insertion was skipped
> vpf-10260: The file we are inserting the new item (294390 692752 0x129 DRCT
> (2), len 296, location 3800 entry count 65535, fsck need 0, format new) into
> has no StatData, insertion was skipped
> 100% left 0, 0 /sec
> Flushing..finished
> Leaves inserted item by item 97
> Pass 3 (semantic):
> ####### Pass 3 #########
> /binrebuild_semantic_pass: The entry [3636 189939] ("ls") in directory [2
> 3636] points to nowhere - is removed
> /javarebuild_semantic_pass: The entry [107571 597512] ("jre") in directory
> [3636 107571] points to nowhere - is removed
> vpf-10650: The directory [3636 107571] has the wrong size in the StatData
> (72) - corrected to (48)
> vpf-10650: The directory [2 3636] has the wrong size in the StatData (2920) -
> corrected to (2896)
> /devrebuild_semantic_pass: The entry [6 554632] ("lvm") in directory [2 6]
> points to nowhere - is removed
> rebuild_semantic_pass: The entry [6 52003] ("lirc") in directory [2 6] points
> to nowhere - is removed
> rebuild_semantic_pass: The entry [6 72207] ("scsi") in directory [2 6] points
> to nowhere - is removed
> rebuild_semantic_pass: The entry [6 50738] ("xdb5") in directory [2 6] points
> to nowhere - is removed
> rebuild_semantic_pass: The entry [6 50739] ("xdb6") in directory [2 6] points
> to nowhere - is removed
> rebuild_semantic_pass: The entry [6 50740] ("xdb7") in directory [2 6] points
> to nowhere - is removed
> rebuild_semantic_pass: The entry [6 50741] ("xdb8") in directory [2 6] points
> to nowhere - is removed
> ...
> ... (here follow hundreds of directories and thousends of files, too,
> ... which I removed)
> ...
> The entry [994339 994340] ("Entries") in directory [994335 19] updated to
> point to [994339 49]
> /Entries.Extra.Oldrewrite_file: 1 items of file [994339 994343] moved to
> [994339 50]
> The entry [994339 994343] ("Entries.Extra.Old") in directory [994335 19]
> updated to point to [994339 50]
> relocate_dir: Moving [994350 994773 0x0 SD (0)] to [994350 51 0x0 SD (0)]
> relocate_dir: Moving [994350 994773 0x1 DIR (3)] to [994350 51 0x1 DIR (3)]
> /994350_51get_next_directory_item: The entry ".." of the directory [994350
> 51] pointes to [285394 994350], instead of [2 18] - corrected
> rebuild_semantic_pass: The entry [994773 994783] ("Root") in directory
> [994350 51] points to nowhere - is removed
> rebuild_semantic_pass: The entry [994773 994776] ("Entries.Extra") in
> directory [994350 51] points to nowhere - is removed
> rebuild_semantic_pass: The entry [994773 994782] ("Repository") in directory
> [994350 51] points to nowhere - is removed
> rebuild_semantic_pass: The entry [994773 994779] ("Entries.Extra.Old.bak") in
> directory [994350 51] points to nowhere - is removed
> rebuild_semantic_pass: The entry [994773 994784] ("Root.bak") in directory
> [994350 51] points to nowhere - is removed
> rebuild_semantic_pass: The entry [994773 994780] ("Entries.Old") in directory
> [994350 51] points to nowhere - is removed
> rebuild_semantic_pass: The entry [994773 994775] ("Entries.bak") in directory
> [994350 51] points to nowhere - is removed
> rebuild_semantic_pass: The entry [994773 994781] ("Entries.Old.bak") in
> directory [994350 51] points to nowhere - is removed
> rebuild_semantic_pass: The entry [994773 994778] ("Entries.Extra.Old") in
> directory [994350 51] points to nowhere - is removed
> rebuild_semantic_pass: The entry [994773 994777] ("Entries.Extra.bak") in
> directory [994350 51] points to nowhere - is removed
> vpf-10650: The directory [994350 51] has the wrong size in the StatData (400)
> - corrected to (72)
> /994395_994396get_next_directory_item: The entry ".." of the directory
> [994395 994396] pointes to [684030 994395], instead of [2 18] - corrected
> /994415_994416get_next_directory_item: The entry ".." of the directory
> [994415 994416] pointes to [684030 994415], instead of [2 18] - corrected
> /994529_994754get_next_directory_item: The entry ".." of the directory
> [994529 994754] pointes to [984867 994529], instead of [2 18] - corrected
> Looking for lost files:
> vpf-10670: The file [25 93091] has the wrong size in the StatData (30352) -
> corrected to (36864)
> vpf-10680: The file [25 93091] has the wrong block count in the StatData (64)
> - corrected to (72)
> vpf-10680: The file [25 111982] has the wrong block count in the StatData
> (75408) - corrected to (16872)
> vpf-10680: The file [3127 59061] has the wrong block count in the StatData
> (8) - corrected to (0)
> vpf-10680: The file [3128 72300] has the wrong block count in the StatData
> (8) - corrected to (0)
> vpf-10680: The file [3620 18950] has the wrong block count in the StatData
> (8) - corrected to (0)
> ...
> ...
> ...
> rewrite_file: 2 items of file [994350 994764] moved to [994350 3108]
> rewrite_file: 2 items of file [994350 994765] moved to [994350 3109]
> rewrite_file: 2 items of file [994350 994766] moved to [994350 3110]
> Flushing..finished
> Objects without names 18403
> Empty lost dirs removed 384
> Dirs linked to /lost+found: 2174
> Dirs without stat data found 83
> Files linked to /lost+found 16229
> Objects having used objectids: 49
> files fixed 47
> dirs fixed 2
> Pass 4 - finished done 1476, 37 /sec
> Deleted unreachable items 716
> Flushing..finished
> Syncing..finished
> ###########
> reiserfsck finished at Tue Feb 8 17:40:05 2005
> ###########
>
