On Wednesday 09 February 2005 10:34, you wrote:
> Christian Placzek wrote:
> >On Wednesday 09 February 2005 09:47, you wrote:
> >>Hello
> >>
> >>On Wed, 2005-02-09 at 01:21, Christian Placzek wrote:
> >>>Hello,
> >>>
> >>>a friend of mine shredded his data (70GB) when he tried to undelete an
> >>>accidentally deleted file. He normally works with windoze. Therefore he
> >>>didn't know he couldn't undelete a file on a reiserfs partition with
> >>> ext2 undelete tool %-(
> >>>When he called me it was already too late. He had overwritten the
> >>>superblock :-(
> >>>
> >>>I'm still trying to rescue the data. I can see them in the image using
> >>>grep or hexedit. But nothing I tried has been successful. My first steps
> >>>were unmounting the partition, taking an image and working with a copy
> >>> of this image using a loop back device.
> >>>
> >>>All files have been retrieved but were removed by reiserfsck --check
> >>>although the last output says that directories and files have been
> >>> linked (see below). I tried with many combinations nearly all
> >>> parameters of reiserfsck: --fix-fixable --no-journal-available -S ...
> >>
> >>have you tried
> >>reiserfsck --rebuild-tree -S
> >>?
> >>If not, run it on newly created copy of shredded device.
> >
> >Yes, I did. The output of reiserfsck --rebuild-tree gave other numbers of
> >linked directories/files. But I can't see them.
> >
> >>Did you look at lost+found?
> >
> >Shure, see below.
>
> Sorry, but what does df -T say?
> Does it say that reiserfs filesystem is mounted on /mnt/temp1?
No, it replied:
# /dev/loop/0 ext2 69529276 20 65997368 1% /mnt/temp1
If I force mount with -t reiserfs it says:
[EMAIL PROTECTED]:/home/kris 0$ # mount -o ro -t reiserfs /dev/loop/0
/mnt/temp1/
mount: wrong fs type, bad option, bad superblock on /dev/loop/0,
or too many mounted file systems
Thanks, this is a good hint, but I don't know how to change the identifier of
the filesystem. I know that normally mkfs.* does this task, but my friend's
overwriting of the superblock probably has changed the identifier of the
filesystem. Is it possible to apply mkreiserfs on the image whithout running
the risk to lose any data?
Thanks
Kris
>
> Thanks,
> Lena.
>
> >>>I mounted the image after each operation, but all I can see is:
> >>>
> >>>[EMAIL PROTECTED]:/home/kris 0$ # mount -o ro /dev/loop/0 /mnt/temp1/
> >>>[EMAIL PROTECTED]:/home/kris 0$ # ls -la /mnt/temp1/
> >>>total 21
> >>>drwxr-xr-x 3 root root 4096 Jan 20 11:36 .
> >>>drwxr-xr-x 39 root root 968 Feb 6 14:12 ..
> >>>drwx------ 2 root root 16384 Jan 20 11:36 lost+found
> >>>[EMAIL PROTECTED]:/home/kris 0$ # ls -la /mnt/temp1/lost+found/
> >>>total 20
> >>>drwx------ 2 root root 16384 Jan 20 11:36 .
> >>>drwxr-xr-x 3 root root 4096 Jan 20 11:36 ..
> >>>[EMAIL PROTECTED]:/home/kris 0$ #
> >>>
> >>>
> >>>Do you have any suggestions how to rescue the data?
> >>>
> >>>Regards
> >>> Kris
> >>>
> >>>
> >>>
> >>>Here you see a typical output:
> >>>
> >>>[EMAIL PROTECTED]:/home/kris 0$ # losetup /dev/loop/0 /mnt/temp/data.x.dd
> >>>[EMAIL PROTECTED]:/home/kris 0$ # reiserfsck /dev/loop/0 --rebuild-tree
> >>>reiserfsck 3.6.19 (2003 www.namesys.com)
> >>>
> >>><snip>
> >>>
> >>>Will rebuild the filesystem (/dev/loop/0) tree
> >>>Will put log info to 'stdout'
> >>>
> >>>Do you want to run this program?[N/Yes] (note need to type Yes if you
> >>>do):Yes
> >>>
> >>>reiserfs_open: the reiserfs superblock cannot be found on /dev/loop/0.
> >>>Failed to open the filesystem.
> >>>
> >>>If the partition table has not been changed, and the partition is
> >>>valid and it really contains a reiserfs partition, then the
> >>>superblock is corrupted and you need to run this utility with
> >>>--rebuild-sb.
> >>>
> >>>[EMAIL PROTECTED]:/home/kris 8$ # reiserfsck /dev/loop/0 --rebuild-sb
> >>>reiserfsck 3.6.19 (2003 www.namesys.com)
> >>>
> >>><snip>
> >>>
> >>>Will check superblock and rebuild it if needed
> >>>Will put log info to 'stdout'
> >>>
> >>>reiserfs_open: the reiserfs superblock cannot be found on /dev/loop/0.
> >>>
> >>>what the version of ReiserFS do you use[1-4]
> >>> (1) 3.6.x
> >>> (2) >=3.5.9 (introduced in the middle of 1999) (if you use linux
> >>>2.2, choose this one)
> >>> (3) < 3.5.9 converted to new format (don't choose if unsure)
> >>> (4) < 3.5.9 (this is very old format, don't choose if unsure)
> >>> (X) exit
> >>>1
> >>>
> >>>Enter block size [4096]:
> >>>
> >>>
> >>>No journal device was specified. (If journal is not available, re-run
> >>>with --no-journal-available option specified).
> >>>Is journal default? (y/n)[y]:
> >>>
> >>>Did you use resizer(y/n)[n]:
> >>>rebuild-sb: no uuid found, a new uuid was generated
> >>>(7e253707-4fef-42aa-9785-b1cd079851af)
> >>>
> >>>rebuild-sb: You either have a corrupted journal or have just changed
> >>>the start of the partition with some partition table editor. If you are
> >>>sure that the start of the partition is ok, rebuild the journal header.
> >>>Do you want to rebuild the journal header? (y/n)[n]: y
> >>>Reiserfs super block in block 16 on 0x700 of format 3.6 with standard
> >>>journal Count of blocks on the device: 17659440
> >>>Number of bitmaps: 539
> >>>Blocksize: 4096
> >>>Free blocks (count of blocks - used [journal, bitmaps, data, reserved]
> >>>blocks): 0
> >>>Root block: 0
> >>>Filesystem is NOT clean
> >>>Tree height: 0
> >>>Hash function used to sort names: not set
> >>>Objectid map size 0, max 972
> >>>Journal parameters:
> >>> Device [0x0]
> >>> Magic [0x0]
> >>> Size 8193 blocks (including 1 for journal header) (first block
> >>>18) Max transaction length 1024 blocks
> >>> Max batch size 900 blocks
> >>> Max commit age 30
> >>>Blocks reserved by journal: 0
> >>>Fs state field: 0x1:
> >>> some corruptions exist.
> >>>sb_version: 2
> >>>inode generation number: 0
> >>>UUID: 7e253707-4fef-42aa-9785-b1cd079851af
> >>>LABEL:
> >>>Set flags in SB:
> >>>Is this ok ? (y/n)[n]: y
> >>>The fs may still be unconsistent. Run reiserfsck --check.
> >>>
> >>>[EMAIL PROTECTED]:/home/kris 1$ # reiserfsck /dev/loop/0 --check
> >>>reiserfsck 3.6.19 (2003 www.namesys.com)
> >>>
> >>><snip>
> >>>
> >>>Will read-only check consistency of the filesystem on /dev/loop/0
> >>>Will put log info to 'stdout'
> >>>###########
> >>>reiserfsck --check started at Tue Feb 8 17:17:31 2005
> >>>###########
> >>>Replaying journal..
> >>>Reiserfs journal '/dev/loop/0' in blocks [18..8211]: 0 transactions
> >>>replayed Zero bit found in on-disk bitmap after the last valid bit.
> >>>Checking internal tree..
> >>>
> >>>Bad root block 0. (--rebuild-tree did not complete)
> >>>
> >>>Aborted
> >>>[EMAIL PROTECTED]:/home/kris 134$ # reiserfsck /dev/loop/0 -y
> >>>--rebuild-tree
> >>>reiserfsck 3.6.19 (2003 www.namesys.com)
> >>>
> >>><snip>
> >>>
> >>>Will rebuild the filesystem (/dev/loop/0) tree
> >>>Will put log info to 'stdout'
> >>>
> >>>Do you want to run this program?[N/Yes] (note need to type Yes if you
> >>>do):Yes Replaying journal..
> >>>Reiserfs journal '/dev/loop/0' in blocks [18..8211]: 0 transactions
> >>>replayed Zero bit found in on-disk bitmap after the last valid bit.
> >>>Fixed. ###########
> >>>reiserfsck --rebuild-tree started at Tue Feb 8 17:37:56 2005
> >>>###########
> >>>
> >>>Pass 0:
> >>>####### Pass 0 #######
> >>>Loading on-disk bitmap .. ok, 559628 blocks marked used
> >>>init_source_bitmap: Bitmap 0 (of 32768 bits) is wrong - mark all blocks
> >>>[0 - 32768] as used
> >>>init_source_bitmap: Bitmap 1 (of 32768 bits) is wrong - mark all blocks
> >>> [32768 - 65536] as used
> >>>init_source_bitmap: Bitmap 3 (of 32768 bits) is wrong - mark all blocks
> >>> [98304 - 131072] as used
> >>>init_source_bitmap: Bitmap 5 (of 32768 bits) is wrong - mark all blocks
> >>>[163840 - 196608] as used
> >>>init_source_bitmap: Bitmap 7 (of 32768 bits) is wrong - mark all blocks
> >>>[229376 - 262144] as used
> >>>init_source_bitmap: Bitmap 9 (of 32768 bits) is wrong - mark all blocks
> >>>[294912 - 327680] as used
> >>>init_source_bitmap: Bitmap 25 (of 32768 bits) is wrong - mark all blocks
> >>>[819200 - 851968] as used
> >>>init_source_bitmap: Bitmap 27 (of 32768 bits) is wrong - mark all blocks
> >>>[884736 - 917504] as used
> >>>init_source_bitmap: Bitmap 49 (of 32768 bits) is wrong - mark all blocks
> >>>[1605632 - 1638400] as used
> >>>init_source_bitmap: Bitmap 81 (of 32768 bits) is wrong - mark all blocks
> >>>[2654208 - 2686976] as used
> >>>init_source_bitmap: Bitmap 125 (of 32768 bits) is wrong - mark all
> >>> blocks [4096000 - 4128768] as used
> >>>init_source_bitmap: Bitmap 243 (of 32768 bits) is wrong - mark all
> >>> blocks [7962624 - 7995392] as used
> >>>init_source_bitmap: Bitmap 343 (of 32768 bits) is wrong - mark all
> >>> blocks [11239424 - 11272192] as used
> >>>Skipping 8749 blocks (super block, journal, bitmaps) 687599 blocks will
> >>>be read
> >>>0%....20%....40%....60%....80%....100% left 0,
> >>>9549 /sec
> >>>103101 directory entries were hashed with "r5" hash.
> >>>Selected hash ("r5") does not match to the hash set in the super block
> >>>(not set).
> >>> "r5" hash is selected
> >>>Flushing..finished
> >>> Read blocks (but not data blocks) 687599
> >>> Leaves among those 20621
> >>> Objectids found 114185
> >>>
> >>>Pass 1 (will try to insert 20621 leaves):
> >>>####### Pass 1 #######
> >>>Looking for allocable blocks .. finished
> >>>0%....20%....40%....60%....80%....100% left 0,
> >>>1718 /sec
> >>>Flushing..finished
> >>> 20621 leaves read
> >>> 20524 inserted
> >>> - pointers in indirect items pointing to
> >>> metadata 3 (zeroed)
> >>> 97 not inserted
> >>> non-unique pointers in indirect items (zeroed) 1075
> >>>####### Pass 2 #######
> >>>
> >>>Pass 2:
> >>>0%....20%....40%....60%vpf-10260: The file we are inserting the new item
> >>>(69291 69327 0x1 DRCT (2), len 216, location 3880 entry count 65535,
> >>> fsck need 0, format new) into has no StatData, insertion was skipped
> >>> ....vpf-10260: The file we are inserting the new item (240148 240150
> >>> 0x1 IND (1), len 1844, location 2252 entry count 0, fsck need 0, format
> >>> new) into has no StatData, insertion was skipped
> >>>vpf-10260: The file we are inserting the new item (241304 319211 0x43001
> >>>IND (1), len 492, location 3604 entry count 0, fsck need 0, format new)
> >>>into has no StatData, insertion was skipped
> >>>vpf-10260: The file we are inserting the new item (737518 739813 0xe6001
> >>>IND (1), len 688, location 3408 entry count 0, fsck need 0, format new)
> >>>into has no StatData, insertion was skipped
> >>>80%vpf-10260: The file we are inserting the new item (737518 739813
> >>>0xe6001 IND (1), len 688, location 3408 entry count 0, fsck need 0,
> >>>format new) into has no StatData, insertion was skipped
> >>>vpf-10260: The file we are inserting the new item (25 93014 0x1e1 DRCT
> >>>(2), len 1408, location 2688 entry count 65535, fsck need 0, format new)
> >>>intohas no StatData, insertion was skipped
> >>>vpf-10260: The file we are inserting the new item (238343 319306
> >>> 0x3f4001 IND (1), len 136, location 3960 entry count 0, fsck need 0,
> >>> format new) into has no StatData, insertion was skipped
> >>>vpf-10260: The file we are inserting the new item (94077 119920 0x1 DRCT
> >>>(2), len 456, location 3640 entry count 65535, fsck need 0, format new)
> >>>into has no StatData, insertion was skipped
> >>>vpf-10260: The file we are inserting the new item (102491 220397 0x179
> >>>DRCT (2), len 1264, location 2832 entry count 65535, fsck need 0, format
> >>>new)into has no StatData, insertion was skipped
> >>>.vpf-10260: The file we are inserting the new item (642448 771721 0xcc1
> >>>DRCT (2), len 520, location 3576 entry count 65535, fsck need 0, format
> >>>new)into has no StatData, insertion was skipped
> >>>.vpf-10260: The file we are inserting the new item (294390 692752 0x129
> >>>DRCT (2), len 296, location 3800 entry count 65535, fsck need 0, format
> >>>new)into has no StatData, insertion was skipped
> >>>vpf-10260: The file we are inserting the new item (294390 692752 0x129
> >>>DRCT (2), len 296, location 3800 entry count 65535, fsck need 0, format
> >>>new) into has no StatData, insertion was skipped
> >>>vpf-10260: The file we are inserting the new item (294390 692752 0x129
> >>>DRCT (2), len 296, location 3800 entry count 65535, fsck need 0, format
> >>>new) into has no StatData, insertion was skipped
> >>>.vpf-10260: The file we are inserting the new item (294390 692752 0x129
> >>>DRCT (2), len 296, location 3800 entry count 65535, fsck need 0, format
> >>>new)into has no StatData, insertion was skipped
> >>>vpf-10260: The file we are inserting the new item (294390 692752 0x129
> >>>DRCT (2), len 296, location 3800 entry count 65535, fsck need 0, format
> >>>new) into has no StatData, insertion was skipped
> >>>vpf-10260: The file we are inserting the new item (294390 692752 0x129
> >>>DRCT (2), len 296, location 3800 entry count 65535, fsck need 0, format
> >>>new) into has no StatData, insertion was skipped
> >>>vpf-10260: The file we are inserting the new item (294390 692752 0x129
> >>>DRCT (2), len 296, location 3800 entry count 65535, fsck need 0, format
> >>>new) into has no StatData, insertion was skipped
> >>>vpf-10260: The file we are inserting the new item (294390 692752 0x129
> >>>DRCT (2), len 296, location 3800 entry count 65535, fsck need 0, format
> >>>new) into has no StatData, insertion was skipped
> >>>.vpf-10260: The file we are inserting the new item (294390 692752 0x129
> >>>DRCT (2), len 296, location 3800 entry count 65535, fsck need 0, format
> >>>new)into has no StatData, insertion was skipped
> >>>vpf-10260: The file we are inserting the new item (294390 692752 0x129
> >>>DRCT (2), len 296, location 3800 entry count 65535, fsck need 0, format
> >>>new) into has no StatData, insertion was skipped
> >>>vpf-10260: The file we are inserting the new item (294390 692752 0x129
> >>>DRCT (2), len 296, location 3800 entry count 65535, fsck need 0, format
> >>>new) into has no StatData, insertion was skipped
> >>>vpf-10260: The file we are inserting the new item (294390 692752 0x129
> >>>DRCT (2), len 296, location 3800 entry count 65535, fsck need 0, format
> >>>new) into has no StatData, insertion was skipped
> >>>100% left 0, 0 /sec
> >>>Flushing..finished
> >>> Leaves inserted item by item 97
> >>>Pass 3 (semantic):
> >>>####### Pass 3 #########
> >>>/binrebuild_semantic_pass: The entry [3636 189939] ("ls") in directory
> >>> [2 3636] points to nowhere - is removed
> >>>/javarebuild_semantic_pass: The entry [107571 597512] ("jre") in
> >>>directory [3636 107571] points to nowhere - is removed
> >>>vpf-10650: The directory [3636 107571] has the wrong size in the
> >>> StatData (72) - corrected to (48)
> >>>vpf-10650: The directory [2 3636] has the wrong size in the StatData
> >>>(2920) - corrected to (2896)
> >>>/devrebuild_semantic_pass: The entry [6 554632] ("lvm") in directory [2
> >>>6] points to nowhere - is removed
> >>>rebuild_semantic_pass: The entry [6 52003] ("lirc") in directory [2 6]
> >>>points to nowhere - is removed
> >>>rebuild_semantic_pass: The entry [6 72207] ("scsi") in directory [2 6]
> >>>points to nowhere - is removed
> >>>rebuild_semantic_pass: The entry [6 50738] ("xdb5") in directory [2 6]
> >>>points to nowhere - is removed
> >>>rebuild_semantic_pass: The entry [6 50739] ("xdb6") in directory [2 6]
> >>>points to nowhere - is removed
> >>>rebuild_semantic_pass: The entry [6 50740] ("xdb7") in directory [2 6]
> >>>points to nowhere - is removed
> >>>rebuild_semantic_pass: The entry [6 50741] ("xdb8") in directory [2 6]
> >>>points to nowhere - is removed
> >>>...
> >>>... (here follow hundreds of directories and thousends of files, too,
> >>>... which I removed)
> >>>...
> >>>The entry [994339 994340] ("Entries") in directory [994335 19] updated
> >>> to point to [994339 49]
> >>>/Entries.Extra.Oldrewrite_file: 1 items of file [994339 994343] moved to
> >>>[994339 50]
> >>>The entry [994339 994343] ("Entries.Extra.Old") in directory [994335 19]
> >>>updated to point to [994339 50]
> >>>relocate_dir: Moving [994350 994773 0x0 SD (0)] to [994350 51 0x0 SD
> >>> (0)] relocate_dir: Moving [994350 994773 0x1 DIR (3)] to [994350 51 0x1
> >>> DIR (3)] /994350_51get_next_directory_item: The entry ".." of the
> >>> directory [994350 51] pointes to [285394 994350], instead of [2 18] -
> >>> corrected rebuild_semantic_pass: The entry [994773 994783] ("Root") in
> >>> directory [994350 51] points to nowhere - is removed
> >>>rebuild_semantic_pass: The entry [994773 994776] ("Entries.Extra") in
> >>>directory [994350 51] points to nowhere - is removed
> >>>rebuild_semantic_pass: The entry [994773 994782] ("Repository") in
> >>>directory [994350 51] points to nowhere - is removed
> >>>rebuild_semantic_pass: The entry [994773 994779]
> >>>("Entries.Extra.Old.bak") in directory [994350 51] points to nowhere -
> >>> is removed
> >>>rebuild_semantic_pass: The entry [994773 994784] ("Root.bak") in
> >>>directory [994350 51] points to nowhere - is removed
> >>>rebuild_semantic_pass: The entry [994773 994780] ("Entries.Old") in
> >>>directory [994350 51] points to nowhere - is removed
> >>>rebuild_semantic_pass: The entry [994773 994775] ("Entries.bak") in
> >>>directory [994350 51] points to nowhere - is removed
> >>>rebuild_semantic_pass: The entry [994773 994781] ("Entries.Old.bak") in
> >>>directory [994350 51] points to nowhere - is removed
> >>>rebuild_semantic_pass: The entry [994773 994778] ("Entries.Extra.Old")
> >>> in directory [994350 51] points to nowhere - is removed
> >>>rebuild_semantic_pass: The entry [994773 994777] ("Entries.Extra.bak")
> >>> in directory [994350 51] points to nowhere - is removed
> >>>vpf-10650: The directory [994350 51] has the wrong size in the StatData
> >>>(400) - corrected to (72)
> >>>/994395_994396get_next_directory_item: The entry ".." of the directory
> >>> [994395 994396] pointes to [684030 994395], instead of [2 18] -
> >>>corrected /994415_994416get_next_directory_item: The entry ".." of the
> >>>directory [994415 994416] pointes to [684030 994415], instead of [2 18]
> >>> - corrected /994529_994754get_next_directory_item: The entry ".." of
> >>> the directory [994529 994754] pointes to [984867 994529], instead of [2
> >>> 18] - corrected Looking for lost files:
> >>>vpf-10670: The file [25 93091] has the wrong size in the StatData
> >>> (30352) - corrected to (36864)
> >>>vpf-10680: The file [25 93091] has the wrong block count in the StatData
> >>>(64) - corrected to (72)
> >>>vpf-10680: The file [25 111982] has the wrong block count in the
> >>> StatData (75408) - corrected to (16872)
> >>>vpf-10680: The file [3127 59061] has the wrong block count in the
> >>>StatData (8) - corrected to (0)
> >>>vpf-10680: The file [3128 72300] has the wrong block count in the
> >>>StatData (8) - corrected to (0)
> >>>vpf-10680: The file [3620 18950] has the wrong block count in the
> >>>StatData (8) - corrected to (0)
> >>>...
> >>>...
> >>>...
> >>>rewrite_file: 2 items of file [994350 994764] moved to [994350 3108]
> >>>rewrite_file: 2 items of file [994350 994765] moved to [994350 3109]
> >>>rewrite_file: 2 items of file [994350 994766] moved to [994350 3110]
> >>>Flushing..finished
> >>> Objects without names 18403
> >>> Empty lost dirs removed 384
> >>> Dirs linked to /lost+found: 2174
> >>> Dirs without stat data found 83
> >>> Files linked to /lost+found 16229
> >>> Objects having used objectids: 49
> >>> files fixed 47
> >>> dirs fixed 2
> >>>Pass 4 - finished done 1476, 37 /sec
> >>> Deleted unreachable items 716
> >>>Flushing..finished
> >>>Syncing..finished
> >>>###########
> >>>reiserfsck finished at Tue Feb 8 17:40:05 2005
> >>>###########
--
Mit freundlichen Gr��en
C. Placzek
----------------------------------------------
Dipl.-Ing. Christian Placzek
Email: [EMAIL PROTECTED]
Anschrift:
Von-G�rschen-Str. 19
52066 Aachen
Tel.: +49 241 9964681
Fax: +49 241 514388
Mobil:+49 179 1083808
