Re: recovering data from a corrupt ext3?

[Alan Cox <alan@lxorguk.ukuu.org.uk>]

On Iau, 2004-12-16 at 18:20, Dan Stromberg wrote:
> 1) Is there a better tool for ext3 data recovery?

You can use e2fsdebug to poke around a bit and to follow inodes. You
might want to start lower down the stack however and check the LVM
claims to be the right size for the file system and any partition data
looks right.

> 2) If there isn't, is there a document that provides an overview of the
> ext3 on-disk filesystem structure, so that I might write a tool for doing
> the recovery?  (I wrote one once for the atari 800 floppy disk filesystem).

This is the stuff e2fsdebug essentially knows about - ext3 is ext2 with
journal so both are very similar.

> 1) What kind of alignment assumptions can I make about the various data
> structures?  EG, if I can assume that a bunch of directory entries always
> start on a 512 byte boundary, that'll speed up directory entry hunting
> considerably.

Superblocks give you all the basic layout information. The disk is split
into cylinder groups which in turn are split into inode and data zones.
Lookups are essentially

	directory entry -> inode number -> inode block

	inode block -> data (first few blocks direct, next indirected once,
then twice ..)


The superblocks will at least be disk block aligned so a good starting
point might be to find the superblocks on the disk itself without LVM in
the way. That should tell you the start/end/layout of the fs and you may
even be able to then pull those blocks into a file and loopback mount
the copy