On Wednesday 09 February 2005 09:47, you wrote:
> Hello
>
> On Wed, 2005-02-09 at 01:21, Christian Placzek wrote:
> > Hello,
> >
> > a friend of mine shredded his data (70GB) when he tried to undelete an
> > accidentally deleted file. He normally works with windoze. Therefore he
> > didn't know he couldn't undelete a file on a reiserfs partition with ext2
> > undelete tool %-(
> > When he called me it was already too late. He had overwritten the
> > superblock :-(
> >
> > I'm still trying to rescue the data. I can see them in the image using
> > grep or hexedit. But nothing I tried has been successful. My first steps
> > were unmounting the partition, taking an image and working with a copy of
> > this image using a loop back device.
> >
> > All files have been retrieved but were removed by reiserfsck --check
> > although the last output says that directories and files have been linked
> > (see below). I tried with many combinations nearly all parameters of
> > reiserfsck: --fix-fixable --no-journal-available -S ...
>
> have you tried
> reiserfsck --rebuild-tree -S
> ?
> If not, run it on newly created copy of shredded device.
>
Yes, I did. The output of reiserfsck --rebuild-tree gave other numbers of
linked directories/files. But I can't see them.
> Did you look at lost+found?
Shure, see below.
>
> > I mounted the image after each operation, but all I can see is:
> >
> > [EMAIL PROTECTED]:/home/kris 0$ # mount -o ro /dev/loop/0 /mnt/temp1/
> > [EMAIL PROTECTED]:/home/kris 0$ # ls -la /mnt/temp1/
> > total 21
> > drwxr-xr-x 3 root root 4096 Jan 20 11:36 .
> > drwxr-xr-x 39 root root 968 Feb 6 14:12 ..
> > drwx------ 2 root root 16384 Jan 20 11:36 lost+found
> > [EMAIL PROTECTED]:/home/kris 0$ # ls -la /mnt/temp1/lost+found/
> > total 20
> > drwx------ 2 root root 16384 Jan 20 11:36 .
> > drwxr-xr-x 3 root root 4096 Jan 20 11:36 ..
> > [EMAIL PROTECTED]:/home/kris 0$ #
> >
> >
> > Do you have any suggestions how to rescue the data?
> >
> > Regards
> > Kris
> >
> >
> >
> > Here you see a typical output:
> >
> > [EMAIL PROTECTED]:/home/kris 0$ # losetup /dev/loop/0 /mnt/temp/data.x.dd
> > [EMAIL PROTECTED]:/home/kris 0$ # reiserfsck /dev/loop/0 --rebuild-tree
> > reiserfsck 3.6.19 (2003 www.namesys.com)
> >
> > <snip>
> >
> > Will rebuild the filesystem (/dev/loop/0) tree
> > Will put log info to 'stdout'
> >
> > Do you want to run this program?[N/Yes] (note need to type Yes if you
> > do):Yes
> >
> > reiserfs_open: the reiserfs superblock cannot be found on /dev/loop/0.
> > Failed to open the filesystem.
> >
> > If the partition table has not been changed, and the partition is
> > valid and it really contains a reiserfs partition, then the
> > superblock is corrupted and you need to run this utility with
> > --rebuild-sb.
> >
> > [EMAIL PROTECTED]:/home/kris 8$ # reiserfsck /dev/loop/0 --rebuild-sb
> > reiserfsck 3.6.19 (2003 www.namesys.com)
> >
> > <snip>
> >
> > Will check superblock and rebuild it if needed
> > Will put log info to 'stdout'
> >
> > reiserfs_open: the reiserfs superblock cannot be found on /dev/loop/0.
> >
> > what the version of ReiserFS do you use[1-4]
> > (1) 3.6.x
> > (2) >=3.5.9 (introduced in the middle of 1999) (if you use linux
> > 2.2, choose this one)
> > (3) < 3.5.9 converted to new format (don't choose if unsure)
> > (4) < 3.5.9 (this is very old format, don't choose if unsure)
> > (X) exit
> > 1
> >
> > Enter block size [4096]:
> >
> >
> > No journal device was specified. (If journal is not available, re-run
> > with --no-journal-available option specified).
> > Is journal default? (y/n)[y]:
> >
> > Did you use resizer(y/n)[n]:
> > rebuild-sb: no uuid found, a new uuid was generated
> > (7e253707-4fef-42aa-9785-b1cd079851af)
> >
> > rebuild-sb: You either have a corrupted journal or have just changed
> > the start of the partition with some partition table editor. If you are
> > sure that the start of the partition is ok, rebuild the journal header.
> > Do you want to rebuild the journal header? (y/n)[n]: y
> > Reiserfs super block in block 16 on 0x700 of format 3.6 with standard
> > journal Count of blocks on the device: 17659440
> > Number of bitmaps: 539
> > Blocksize: 4096
> > Free blocks (count of blocks - used [journal, bitmaps, data, reserved]
> > blocks): 0
> > Root block: 0
> > Filesystem is NOT clean
> > Tree height: 0
> > Hash function used to sort names: not set
> > Objectid map size 0, max 972
> > Journal parameters:
> > Device [0x0]
> > Magic [0x0]
> > Size 8193 blocks (including 1 for journal header) (first block
> > 18) Max transaction length 1024 blocks
> > Max batch size 900 blocks
> > Max commit age 30
> > Blocks reserved by journal: 0
> > Fs state field: 0x1:
> > some corruptions exist.
> > sb_version: 2
> > inode generation number: 0
> > UUID: 7e253707-4fef-42aa-9785-b1cd079851af
> > LABEL:
> > Set flags in SB:
> > Is this ok ? (y/n)[n]: y
> > The fs may still be unconsistent. Run reiserfsck --check.
> >
> > [EMAIL PROTECTED]:/home/kris 1$ # reiserfsck /dev/loop/0 --check
> > reiserfsck 3.6.19 (2003 www.namesys.com)
> >
> > <snip>
> >
> > Will read-only check consistency of the filesystem on /dev/loop/0
> > Will put log info to 'stdout'
> > ###########
> > reiserfsck --check started at Tue Feb 8 17:17:31 2005
> > ###########
> > Replaying journal..
> > Reiserfs journal '/dev/loop/0' in blocks [18..8211]: 0 transactions
> > replayed Zero bit found in on-disk bitmap after the last valid bit.
> > Checking internal tree..
> >
> > Bad root block 0. (--rebuild-tree did not complete)
> >
> > Aborted
> > [EMAIL PROTECTED]:/home/kris 134$ # reiserfsck /dev/loop/0 -y --rebuild-tree
> > reiserfsck 3.6.19 (2003 www.namesys.com)
> >
> > <snip>
> >
> > Will rebuild the filesystem (/dev/loop/0) tree
> > Will put log info to 'stdout'
> >
> > Do you want to run this program?[N/Yes] (note need to type Yes if you
> > do):Yes Replaying journal..
> > Reiserfs journal '/dev/loop/0' in blocks [18..8211]: 0 transactions
> > replayed Zero bit found in on-disk bitmap after the last valid bit.
> > Fixed. ###########
> > reiserfsck --rebuild-tree started at Tue Feb 8 17:37:56 2005
> > ###########
> >
> > Pass 0:
> > ####### Pass 0 #######
> > Loading on-disk bitmap .. ok, 559628 blocks marked used
> > init_source_bitmap: Bitmap 0 (of 32768 bits) is wrong - mark all blocks
> > [0 - 32768] as used
> > init_source_bitmap: Bitmap 1 (of 32768 bits) is wrong - mark all blocks
> > [32768 - 65536] as used
> > init_source_bitmap: Bitmap 3 (of 32768 bits) is wrong - mark all blocks
> > [98304 - 131072] as used
> > init_source_bitmap: Bitmap 5 (of 32768 bits) is wrong - mark all blocks
> > [163840 - 196608] as used
> > init_source_bitmap: Bitmap 7 (of 32768 bits) is wrong - mark all blocks
> > [229376 - 262144] as used
> > init_source_bitmap: Bitmap 9 (of 32768 bits) is wrong - mark all blocks
> > [294912 - 327680] as used
> > init_source_bitmap: Bitmap 25 (of 32768 bits) is wrong - mark all blocks
> > [819200 - 851968] as used
> > init_source_bitmap: Bitmap 27 (of 32768 bits) is wrong - mark all blocks
> > [884736 - 917504] as used
> > init_source_bitmap: Bitmap 49 (of 32768 bits) is wrong - mark all blocks
> > [1605632 - 1638400] as used
> > init_source_bitmap: Bitmap 81 (of 32768 bits) is wrong - mark all blocks
> > [2654208 - 2686976] as used
> > init_source_bitmap: Bitmap 125 (of 32768 bits) is wrong - mark all blocks
> > [4096000 - 4128768] as used
> > init_source_bitmap: Bitmap 243 (of 32768 bits) is wrong - mark all blocks
> > [7962624 - 7995392] as used
> > init_source_bitmap: Bitmap 343 (of 32768 bits) is wrong - mark all blocks
> > [11239424 - 11272192] as used
> > Skipping 8749 blocks (super block, journal, bitmaps) 687599 blocks will
> > be read
> > 0%....20%....40%....60%....80%....100% left 0,
> > 9549 /sec
> > 103101 directory entries were hashed with "r5" hash.
> > Selected hash ("r5") does not match to the hash set in the super block
> > (not set).
> > "r5" hash is selected
> > Flushing..finished
> > Read blocks (but not data blocks) 687599
> > Leaves among those 20621
> > Objectids found 114185
> >
> > Pass 1 (will try to insert 20621 leaves):
> > ####### Pass 1 #######
> > Looking for allocable blocks .. finished
> > 0%....20%....40%....60%....80%....100% left 0,
> > 1718 /sec
> > Flushing..finished
> > 20621 leaves read
> > 20524 inserted
> > - pointers in indirect items pointing to metadata
> > 3 (zeroed)
> > 97 not inserted
> > non-unique pointers in indirect items (zeroed) 1075
> > ####### Pass 2 #######
> >
> > Pass 2:
> > 0%....20%....40%....60%vpf-10260: The file we are inserting the new item
> > (69291 69327 0x1 DRCT (2), len 216, location 3880 entry count 65535, fsck
> > need 0, format new) into has no StatData, insertion was skipped
> > ....vpf-10260: The file we are inserting the new item (240148 240150 0x1
> > IND (1), len 1844, location 2252 entry count 0, fsck need 0, format new)
> > into has no StatData, insertion was skipped
> > vpf-10260: The file we are inserting the new item (241304 319211 0x43001
> > IND (1), len 492, location 3604 entry count 0, fsck need 0, format new)
> > into has no StatData, insertion was skipped
> > vpf-10260: The file we are inserting the new item (737518 739813 0xe6001
> > IND (1), len 688, location 3408 entry count 0, fsck need 0, format new)
> > into has no StatData, insertion was skipped
> > 80%vpf-10260: The file we are inserting the new item (737518 739813
> > 0xe6001 IND (1), len 688, location 3408 entry count 0, fsck need 0,
> > format new) into has no StatData, insertion was skipped
> > vpf-10260: The file we are inserting the new item (25 93014 0x1e1 DRCT
> > (2), len 1408, location 2688 entry count 65535, fsck need 0, format new)
> > intohas no StatData, insertion was skipped
> > vpf-10260: The file we are inserting the new item (238343 319306 0x3f4001
> > IND (1), len 136, location 3960 entry count 0, fsck need 0, format new)
> > into has no StatData, insertion was skipped
> > vpf-10260: The file we are inserting the new item (94077 119920 0x1 DRCT
> > (2), len 456, location 3640 entry count 65535, fsck need 0, format new)
> > into has no StatData, insertion was skipped
> > vpf-10260: The file we are inserting the new item (102491 220397 0x179
> > DRCT (2), len 1264, location 2832 entry count 65535, fsck need 0, format
> > new)into has no StatData, insertion was skipped
> > .vpf-10260: The file we are inserting the new item (642448 771721 0xcc1
> > DRCT (2), len 520, location 3576 entry count 65535, fsck need 0, format
> > new)into has no StatData, insertion was skipped
> > .vpf-10260: The file we are inserting the new item (294390 692752 0x129
> > DRCT (2), len 296, location 3800 entry count 65535, fsck need 0, format
> > new)into has no StatData, insertion was skipped
> > vpf-10260: The file we are inserting the new item (294390 692752 0x129
> > DRCT (2), len 296, location 3800 entry count 65535, fsck need 0, format
> > new) into has no StatData, insertion was skipped
> > vpf-10260: The file we are inserting the new item (294390 692752 0x129
> > DRCT (2), len 296, location 3800 entry count 65535, fsck need 0, format
> > new) into has no StatData, insertion was skipped
> > .vpf-10260: The file we are inserting the new item (294390 692752 0x129
> > DRCT (2), len 296, location 3800 entry count 65535, fsck need 0, format
> > new)into has no StatData, insertion was skipped
> > vpf-10260: The file we are inserting the new item (294390 692752 0x129
> > DRCT (2), len 296, location 3800 entry count 65535, fsck need 0, format
> > new) into has no StatData, insertion was skipped
> > vpf-10260: The file we are inserting the new item (294390 692752 0x129
> > DRCT (2), len 296, location 3800 entry count 65535, fsck need 0, format
> > new) into has no StatData, insertion was skipped
> > vpf-10260: The file we are inserting the new item (294390 692752 0x129
> > DRCT (2), len 296, location 3800 entry count 65535, fsck need 0, format
> > new) into has no StatData, insertion was skipped
> > vpf-10260: The file we are inserting the new item (294390 692752 0x129
> > DRCT (2), len 296, location 3800 entry count 65535, fsck need 0, format
> > new) into has no StatData, insertion was skipped
> > .vpf-10260: The file we are inserting the new item (294390 692752 0x129
> > DRCT (2), len 296, location 3800 entry count 65535, fsck need 0, format
> > new)into has no StatData, insertion was skipped
> > vpf-10260: The file we are inserting the new item (294390 692752 0x129
> > DRCT (2), len 296, location 3800 entry count 65535, fsck need 0, format
> > new) into has no StatData, insertion was skipped
> > vpf-10260: The file we are inserting the new item (294390 692752 0x129
> > DRCT (2), len 296, location 3800 entry count 65535, fsck need 0, format
> > new) into has no StatData, insertion was skipped
> > vpf-10260: The file we are inserting the new item (294390 692752 0x129
> > DRCT (2), len 296, location 3800 entry count 65535, fsck need 0, format
> > new) into has no StatData, insertion was skipped
> > 100% left 0, 0 /sec
> > Flushing..finished
> > Leaves inserted item by item 97
> > Pass 3 (semantic):
> > ####### Pass 3 #########
> > /binrebuild_semantic_pass: The entry [3636 189939] ("ls") in directory [2
> > 3636] points to nowhere - is removed
> > /javarebuild_semantic_pass: The entry [107571 597512] ("jre") in
> > directory [3636 107571] points to nowhere - is removed
> > vpf-10650: The directory [3636 107571] has the wrong size in the StatData
> > (72) - corrected to (48)
> > vpf-10650: The directory [2 3636] has the wrong size in the StatData
> > (2920) - corrected to (2896)
> > /devrebuild_semantic_pass: The entry [6 554632] ("lvm") in directory [2
> > 6] points to nowhere - is removed
> > rebuild_semantic_pass: The entry [6 52003] ("lirc") in directory [2 6]
> > points to nowhere - is removed
> > rebuild_semantic_pass: The entry [6 72207] ("scsi") in directory [2 6]
> > points to nowhere - is removed
> > rebuild_semantic_pass: The entry [6 50738] ("xdb5") in directory [2 6]
> > points to nowhere - is removed
> > rebuild_semantic_pass: The entry [6 50739] ("xdb6") in directory [2 6]
> > points to nowhere - is removed
> > rebuild_semantic_pass: The entry [6 50740] ("xdb7") in directory [2 6]
> > points to nowhere - is removed
> > rebuild_semantic_pass: The entry [6 50741] ("xdb8") in directory [2 6]
> > points to nowhere - is removed
> > ...
> > ... (here follow hundreds of directories and thousends of files, too,
> > ... which I removed)
> > ...
> > The entry [994339 994340] ("Entries") in directory [994335 19] updated to
> > point to [994339 49]
> > /Entries.Extra.Oldrewrite_file: 1 items of file [994339 994343] moved to
> > [994339 50]
> > The entry [994339 994343] ("Entries.Extra.Old") in directory [994335 19]
> > updated to point to [994339 50]
> > relocate_dir: Moving [994350 994773 0x0 SD (0)] to [994350 51 0x0 SD (0)]
> > relocate_dir: Moving [994350 994773 0x1 DIR (3)] to [994350 51 0x1 DIR
> > (3)] /994350_51get_next_directory_item: The entry ".." of the directory
> > [994350 51] pointes to [285394 994350], instead of [2 18] - corrected
> > rebuild_semantic_pass: The entry [994773 994783] ("Root") in directory
> > [994350 51] points to nowhere - is removed
> > rebuild_semantic_pass: The entry [994773 994776] ("Entries.Extra") in
> > directory [994350 51] points to nowhere - is removed
> > rebuild_semantic_pass: The entry [994773 994782] ("Repository") in
> > directory [994350 51] points to nowhere - is removed
> > rebuild_semantic_pass: The entry [994773 994779]
> > ("Entries.Extra.Old.bak") in directory [994350 51] points to nowhere - is
> > removed
> > rebuild_semantic_pass: The entry [994773 994784] ("Root.bak") in
> > directory [994350 51] points to nowhere - is removed
> > rebuild_semantic_pass: The entry [994773 994780] ("Entries.Old") in
> > directory [994350 51] points to nowhere - is removed
> > rebuild_semantic_pass: The entry [994773 994775] ("Entries.bak") in
> > directory [994350 51] points to nowhere - is removed
> > rebuild_semantic_pass: The entry [994773 994781] ("Entries.Old.bak") in
> > directory [994350 51] points to nowhere - is removed
> > rebuild_semantic_pass: The entry [994773 994778] ("Entries.Extra.Old") in
> > directory [994350 51] points to nowhere - is removed
> > rebuild_semantic_pass: The entry [994773 994777] ("Entries.Extra.bak") in
> > directory [994350 51] points to nowhere - is removed
> > vpf-10650: The directory [994350 51] has the wrong size in the StatData
> > (400) - corrected to (72)
> > /994395_994396get_next_directory_item: The entry ".." of the directory
> > [994395 994396] pointes to [684030 994395], instead of [2 18] -
> > corrected /994415_994416get_next_directory_item: The entry ".." of the
> > directory [994415 994416] pointes to [684030 994415], instead of [2 18] -
> > corrected /994529_994754get_next_directory_item: The entry ".." of the
> > directory [994529 994754] pointes to [984867 994529], instead of [2 18] -
> > corrected Looking for lost files:
> > vpf-10670: The file [25 93091] has the wrong size in the StatData (30352)
> > - corrected to (36864)
> > vpf-10680: The file [25 93091] has the wrong block count in the StatData
> > (64) - corrected to (72)
> > vpf-10680: The file [25 111982] has the wrong block count in the StatData
> > (75408) - corrected to (16872)
> > vpf-10680: The file [3127 59061] has the wrong block count in the
> > StatData (8) - corrected to (0)
> > vpf-10680: The file [3128 72300] has the wrong block count in the
> > StatData (8) - corrected to (0)
> > vpf-10680: The file [3620 18950] has the wrong block count in the
> > StatData (8) - corrected to (0)
> > ...
> > ...
> > ...
> > rewrite_file: 2 items of file [994350 994764] moved to [994350 3108]
> > rewrite_file: 2 items of file [994350 994765] moved to [994350 3109]
> > rewrite_file: 2 items of file [994350 994766] moved to [994350 3110]
> > Flushing..finished
> > Objects without names 18403
> > Empty lost dirs removed 384
> > Dirs linked to /lost+found: 2174
> > Dirs without stat data found 83
> > Files linked to /lost+found 16229
> > Objects having used objectids: 49
> > files fixed 47
> > dirs fixed 2
> > Pass 4 - finished done 1476, 37 /sec
> > Deleted unreachable items 716
> > Flushing..finished
> > Syncing..finished
> > ###########
> > reiserfsck finished at Tue Feb 8 17:40:05 2005
> > ###########
--
Mit freundlichen Gr��en
C. Placzek
----------------------------------------------
Dipl.-Ing. Christian Placzek
Email: [EMAIL PROTECTED]
Anschrift:
Von-G�rschen-Str. 19
52066 Aachen
Tel.: +49 241 9964681
Fax: +49 241 514388
Mobil:+49 179 1083808
