All of lore.kernel.org
 help / color / mirror / Atom feed
* fsck ate my ext4 home partition, help!?
@ 2009-05-04 13:11 Marcel Partap
  2009-05-05  5:33 ` Christian Kujau
  0 siblings, 1 reply; 8+ messages in thread
From: Marcel Partap @ 2009-05-04 13:11 UTC (permalink / raw)
  To: linux-ext4

Dear fs hackers,
some days ago, out of a sudden i was missing some two hundred pics from my digicam, so when i rebooted my comp (which, mysteriously enough, had hung up to the point where even SYSRQ+B would not work) yesterday and X was just starting (i.e. the home partition was already mounted) i decided to stop xdm service and unmount the filesystem to run a quick check over it. Unmounting went successful, however fsck complained about /dev/sdd4 still being mounted. After confirming (lsof, mtab, empty mount point) that that was not actually the case, i ran fsck -p -v /dev/sdd4 and continued (beyond the fake still-mounted warning).. whereas the previous run of e2fsck with the -n was showing a bunch of stuff to fix, it now instantly bailed out complaining about broken superblock and so on. After that, fsck -n still showed a bunch of (the same?) errors to fix, but remounting the filesystem (already with a bad hunch of course) revealed the havoc that was done: ls -laR showed abundant I/O errors, file names AND attributes consisting of umlauts and question marks, and df reported the size of the fs suddenly at 64 ZETTABYTE! Doom. Remounted ro, root directory looked kinda fine, some stuff was still accessible, but especially the home directory on there not even showed . and .. entries! Obviously this is quite bad, and after having dded the partition to a backup image, i am still unsure on how to approach a recovery of this situation. For sure the data is still there, but how to get at it? It's quite an old volume aswell so probably fragmented heavily...
As i am in uni right now i don't have access to the complete screen buffer log but i can provide to anyone who has any idea how to fix this. If someone can actually help me to get it back in the state it was before invoking e2fsk, i'd be overly thankful and would show my appreciation through a 50$ paypal donation. Please, someone help me unscrew this mess *g
For the record, i am running kernel 2.6.30 RC3 with gentoo's e2fsprogs-1.41.3.. and i have not rebooted the system since the incident so maybe some guerilla forensics can work on my 8GB of RAM?
thx & regards, marcel..
-- 
Neu: GMX FreeDSL Komplettanschluss mit DSL 6.000 Flatrate + Telefonanschluss für nur 17,95 Euro/mtl.!* http://dslspecial.gmx.de/freedsl-surfflat/?ac=OM.AD.PD003K11308T4569a
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: fsck ate my ext4 home partition, help!?
  2009-05-04 13:11 fsck ate my ext4 home partition, help!? Marcel Partap
@ 2009-05-05  5:33 ` Christian Kujau
  2009-05-05 14:44   ` Marcel Partap
  2009-05-05 15:06   ` Marcel Partap
  0 siblings, 2 replies; 8+ messages in thread
From: Christian Kujau @ 2009-05-05  5:33 UTC (permalink / raw)
  To: Marcel Partap; +Cc: linux-ext4

On Mon, 4 May 2009, Marcel Partap wrote:
> check over it. Unmounting went successful, however fsck complained about 
> /dev/sdd4 still being mounted. After confirming (lsof, mtab, empty mount 

Have you checked /proc/mounts? mtab could be stale, lsof not seeing 
everything and the "empty mountpoint" could be some other mount on top of 
/home.

> previous run of e2fsck with the -n was showing a bunch of stuff to fix, 

Do you still have that e2fsck output?

> revealed the havoc that was done: ls -laR showed abundant I/O errors, 

Again: error messages would be helpful.

> If someone can actually help me to get it back in the state it was
> before invoking e2fsk,

You did not take the dd image before the first e2fsck, hm? Now that you 
have a backup: a few days ago a tool called "extundelete"[0] has been 
annunced on ext3-users, maybe that can be of help recovering your fs.

> For the record, i am running kernel 2.6.30 RC3 with gentoo's 
> e2fsprogs-1.41.3.. and i have not rebooted the system since the incident 

e2fsprogs-1.41.5 has been released recently, you might want to give it a 
shot.

Christian.

[0] http://extundelete.sf.net/
-- 
Perfect Forward Secrecy is when Bruce Schneier whispers something in your ear.

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: fsck ate my ext4 home partition, help!?
  2009-05-05  5:33 ` Christian Kujau
@ 2009-05-05 14:44   ` Marcel Partap
  2009-05-05 16:51     ` Andreas Dilger
  2009-05-05 20:49     ` Christian Kujau
  2009-05-05 15:06   ` Marcel Partap
  1 sibling, 2 replies; 8+ messages in thread
From: Marcel Partap @ 2009-05-05 14:44 UTC (permalink / raw)
  To: Christian Kujau; +Cc: linux-ext4


> Have you checked /proc/mounts? mtab could be stale, lsof not seeing 
> everything and the "empty mountpoint" could be some other mount on top of 
> /home.
Well how did that happen. It indeed still shows up there:
/dev/sdd4 /home ext3 rw,noatime,nodiratime,errors=continue,user_xattr,data=writeback 0 0
Which btw means this actually is an ext3 volume, confirmed by fstab. How did i miss this. Fo0 bar!

> 
> > previous run of e2fsck with the -n was showing a bunch of stuff to fix, 
> Do you still have that e2fsck output?
> > revealed the havoc that was done: ls -laR showed abundant I/O errors, 
> Again: error messages would be helpful.
Sending you the screen output buffer in a minute.

> You did not take the dd image before the first e2fsck, hm?
Well backing up files before trashing them is sooo unadventurous aint it. e2fsck really needs the ability to write all actions to an undo log file. By default. Hmmpf.

> Now that you 
> have a backup: a few days ago a tool called "extundelete"[0] has been 
> annunced on ext3-users, maybe that can be of help recovering your fs.
Going to let it loose on the partition and have a go, hopefully i don't have to free another 300gig for it to recover the files...


> e2fsprogs-1.41.5 has been released recently, you might want to give it a 
> shot.
Hmm will have a look at the changelog and recompile, thx for the notice.

> Christian.
> Perfect Forward Secrecy is when Bruce Schneier whispers something in your
> ear.
Thx so much for your time and effort to provide with a new mission briefing. On to recovery and BEYOND!!!
marcel ;)
-- 
Psssst! Schon vom neuen GMX MultiMessenger gehört? Der kann`s mit allen: http://www.gmx.net/de/go/multimessenger01
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: fsck ate my ext4 home partition, help!?
  2009-05-05  5:33 ` Christian Kujau
  2009-05-05 14:44   ` Marcel Partap
@ 2009-05-05 15:06   ` Marcel Partap
  1 sibling, 0 replies; 8+ messages in thread
From: Marcel Partap @ 2009-05-05 15:06 UTC (permalink / raw)
  To: Christian Kujau; +Cc: linux-ext4

Ok, i see more clearly now the vast extents of my stupidity, and the gap between perception and reality:
- the partition is and has been ext3 all the way (sorry linux-ext4 for misspamming!)
- i treated /proc/mounts with ignorance
- it seems out of lazyness i did not actually check lsof/ mount point the way i should have (ouch! what i did was as good indeed as not doing anything.. looking/grepping for the WRONG mount path eew)
- the BOINC daemon was running and holding locks on its working directory, even still until i just shut it down. SHEESH! Sometimes it just needs a couple more iterations of rereconsidering the actual situation.

So people, treat your filesystems with the respect and attention they deserve. And TRUST warning messages spit out by highly adept file system tools MORE than your intuition. These tools *do* work as advertised.
Well and the point about backing up precious stuff -=[before]=- knocking out your FS structures already has been made before i guess.

regards marcel.
-- 
Neu: GMX FreeDSL Komplettanschluss mit DSL 6.000 Flatrate + Telefonanschluss für nur 17,95 Euro/mtl.!* http://dslspecial.gmx.de/freedsl-surfflat/?ac=OM.AD.PD003K11308T4569a
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: fsck ate my ext4 home partition, help!?
  2009-05-05 14:44   ` Marcel Partap
@ 2009-05-05 16:51     ` Andreas Dilger
  2009-05-05 20:49     ` Christian Kujau
  1 sibling, 0 replies; 8+ messages in thread
From: Andreas Dilger @ 2009-05-05 16:51 UTC (permalink / raw)
  To: Marcel Partap; +Cc: Christian Kujau, linux-ext4

On May 05, 2009  16:44 +0200, Marcel Partap wrote:
> > You did not take the dd image before the first e2fsck, hm?
> Well backing up files before trashing them is sooo unadventurous aint it.
> e2fsck really needs the ability to write all actions to an undo log file.
> By default. Hmmpf.

There is a feature in newer e2fsprogs that does create an undo log for
e2fsck, but the performance isn't necessarily great.  I don't know how
bad it gets, but maybe for the majority of people this would be an
acceptable alternative to the risk of major filesystem errors.

Cheers, Andreas
--
Andreas Dilger
Sr. Staff Engineer, Lustre Group
Sun Microsystems of Canada, Inc.


^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: fsck ate my ext4 home partition, help!?
  2009-05-05 14:44   ` Marcel Partap
  2009-05-05 16:51     ` Andreas Dilger
@ 2009-05-05 20:49     ` Christian Kujau
  2009-05-06 13:43       ` Marcel Partap
  1 sibling, 1 reply; 8+ messages in thread
From: Christian Kujau @ 2009-05-05 20:49 UTC (permalink / raw)
  To: Marcel Partap; +Cc: linux-ext4

[-- Attachment #1: Type: TEXT/PLAIN, Size: 1640 bytes --]

On Tue, 5 May 2009, Marcel Partap wrote:
> Sending you the screen output buffer in a minute.

I took the liberty and attached a part of your log to this email.
>From what I can see, fsck warns every time that the filesystem is mounted, 
while in fact it is not (or so it seems, still: /proc/mounts should have 
told for sure). But you ran e2fsck almost always in interactive or 
readonly mode, only 2 times e2fsck attempted to alter the fs:

----------------------
localhost ~ # fsck -p -v /dev/sdd4
fsck 1.41.4 (27-Jan-2009)
/dev/sdd4 is mounted.
WARNING!!!  Running e2fsck on a mounted filesystem may cause
SEVERE filesystem damage.
Do you really want to continue (y/n)? yes
/dev/sdd4: recovering journal
fsck.ext3: Bad magic number in super-block while trying to re-open /dev/sdd4
----------------------

And the 2nd time it reported:

----------------------
fsck.ext3: Bad magic number in super-block while trying to open /dev/sdd4
/dev/sdd4: The superblock could not be read or does not describe a correct ext2
----------------------

Now that you have a backup copy, I'd suggest to get that "but sdd4 is 
mounted" error out of the way and try to e2fsck with a different 
superblock. I find it a bit harsh for ext3 to bail out completly when 
almost nothing has been altered by e2fsck. Then again, we still don't know 
what caused the filesystem errors in the first place and how long they 
have been there, waiting to be discovered by these weird e2fsck runs...

Christian.
-- 
On Bruce Schneier's birthday, a person standing at the very center of
Stonehenge casts a shadow in the shape of Bruce Schneier's PGP public key
fingerprint.

[-- Attachment #2: Type: TEXT/PLAIN, Size: 21821 bytes --]

localhost ~ # mount
rootfs on / type rootfs (rw)
/dev/root on / type ext4 (rw,noatime,nodiratime,barrier=1,data=ordered)
proc on /proc type proc (rw,relatime)
rc-svcdir on /lib64/rc/init.d type tmpfs (rw,nosuid,nodev,noexec,relatime,size=1024k,mode=755)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
debugfs on /sys/kernel/debug type debugfs (rw,nosuid,nodev,noexec,relatime)
udev on /dev type tmpfs (rw,nosuid,relatime,size=10240k,mode=755)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
shm on /dev/shm type tmpfs (rw,nosuid,nodev,noexec,relatime)
cachedir on /lib64/splash/cache type tmpfs (rw,relatime,size=4096k,mode=644)
/dev/sda5 on /boot type ext2 (rw,noatime,nodiratime)
/dev/sda3 on /mnt/sda3 type ext4 (rw,noatime,nodiratime,data=journal)
/dev/sda4 on /mnt/sda4 type ext4 (rw,noatime,nodiratime)
/dev/sdc1 on /mnt/sdd1 type fuseblk (rw,noatime,allow_other,blksize=4096)
/dev/sdc2 on /mnt/sdd2 type ext3 (rw,noatime,nodiratime)
/dev/sdd4 on /mnt/sdc4 type ext3 (rw,noatime,nodiratime,user_xattr)
/dev/sdb9 on /mnt/sdd9 type vfat (rw,noexec,nosuid,nodev,noatime,nodiratime,utf8=true,uid=1000,gid=100)
/dev/sdb14 on /mnt/sdd14 type reiserfs (rw,nosuid,nodev,noatime,nodiratime,user_xattr)
/mnt/sdc4/homedirs/currenthomebase on /home type none (rw,bind)
/mnt/sdd14/ftpupload on /home/ftp type none (rw,bind)
usbfs on /proc/bus/usb type usbfs (rw,noexec,nosuid,devmode=0664,devgid=85)
nfsd on /proc/fs/nfsd type nfsd (rw,noexec,nosuid,nodev)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,noexec,nosuid,nodev)
localhost ~ # umount -v /mnt/sdc4
/dev/sdd4 umounted
localhost ~ # umount -v /mnt/sdc4
Could not find /mnt/sdc4 in mtab
umount: /mnt/sdc4: not mounted
localhost ~ # fsck --help
fsck 1.41.4 (27-Jan-2009)
fsck.ext4: invalid option -- 'h'
Usage: fsck.ext4 [-panyrcdfvtDFV] [-b superblock] [-B blocksize]
                [-I inode_buffer_blocks] [-P process_inode_size]
                [-l|-L bad_blocks_file] [-C fd] [-j external_journal]
                [-E extended-options] device

Emergency help:
 -p                   Automatic repair (no questions)
 -n                   Make no changes to the filesystem
 -y                   Assume "yes" to all questions
 -c                   Check for bad blocks and add them to the badblock list
 -f                   Force checking even if filesystem is marked clean
 -v                   Be verbose
 -b superblock        Use alternative superblock
 -B blocksize         Force blocksize when looking for superblock
 -j external_journal  Set location of the external journal
 -l bad_blocks_file   Add to badblocks list
 -L bad_blocks_file   Set badblocks list
localhost ~ # fsck -n -v /dev/sdd4
fsck 1.41.4 (27-Jan-2009)
e2fsck 1.41.4 (27-Jan-2009)
Warning!  /dev/sdd4 is mounted.
Warning: skipping journal recovery because doing a read-only filesystem check.
Superblock last mount time is in the future.  Fix? no

Superblock last write time is in the future.  Fix? no

/dev/sdd4 contains a file system with errors, check forced.
Pass 1: Checking inodes, blocks, and sizes
Inodes that were part of a corrupted orphan linked list found.  Fix? no

Inode 1540203 was part of the orphaned inode list.  IGNORED.
Inode 1540204 was part of the orphaned inode list.  IGNORED.
Inode 1540206 was part of the orphaned inode list.  IGNORED.
Deleted inode 3326214 has zero dtime.  Fix? no

Inode 4215095 was part of the orphaned inode list.  IGNORED.
Deleted inode 13058052 has zero dtime.  Fix? no

Inode 13058106 was part of the orphaned inode list.  IGNORED.
Deleted inode 14748198 has zero dtime.  Fix? no

Deleted inode 15155215 has zero dtime.  Fix? no

^C/dev/sdd4: e2fsck canceled.

/dev/sdd4: ********** WARNING: Filesystem still has errors **********

localhost ~ # fsck --help
fsck 1.41.4 (27-Jan-2009)
fsck.ext4: invalid option -- 'h'
Usage: fsck.ext4 [-panyrcdfvtDFV] [-b superblock] [-B blocksize]
                [-I inode_buffer_blocks] [-P process_inode_size]
                [-l|-L bad_blocks_file] [-C fd] [-j external_journal]
                [-E extended-options] device

Emergency help:
 -p                   Automatic repair (no questions)
 -n                   Make no changes to the filesystem
 -y                   Assume "yes" to all questions
 -c                   Check for bad blocks and add them to the badblock list
 -f                   Force checking even if filesystem is marked clean
 -v                   Be verbose
 -b superblock        Use alternative superblock
 -B blocksize         Force blocksize when looking for superblock
 -j external_journal  Set location of the external journal
 -l bad_blocks_file   Add to badblocks list
 -L bad_blocks_file   Set badblocks list
localhost ~ # fsck -p -v /dev/sdd4
fsck 1.41.4 (27-Jan-2009)
/dev/sdd4 is mounted.

WARNING!!!  Running e2fsck on a mounted filesystem may cause
SEVERE filesystem damage.

Do you really want to continue (y/n)? yes

/dev/sdd4: recovering journal
fsck.ext3: Bad magic number in super-block while trying to re-open /dev/sdd4
Warning... fsck.ext3 for device /dev/sdd4 exited with signal 11.
localhost ~ # mount
rootfs on / type rootfs (rw)
/dev/root on / type ext4 (rw,noatime,nodiratime,barrier=1,data=ordered)
proc on /proc type proc (rw,relatime)
rc-svcdir on /lib64/rc/init.d type tmpfs (rw,nosuid,nodev,noexec,relatime,size=1024k,mode=755)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
debugfs on /sys/kernel/debug type debugfs (rw,nosuid,nodev,noexec,relatime)
udev on /dev type tmpfs (rw,nosuid,relatime,size=10240k,mode=755)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
shm on /dev/shm type tmpfs (rw,nosuid,nodev,noexec,relatime)
cachedir on /lib64/splash/cache type tmpfs (rw,relatime,size=4096k,mode=644)
/dev/sda5 on /boot type ext2 (rw,noatime,nodiratime)
/dev/sda3 on /mnt/sda3 type ext4 (rw,noatime,nodiratime,data=journal)
/dev/sda4 on /mnt/sda4 type ext4 (rw,noatime,nodiratime)
/dev/sdc1 on /mnt/sdd1 type fuseblk (rw,noatime,allow_other,blksize=4096)
/dev/sdc2 on /mnt/sdd2 type ext3 (rw,noatime,nodiratime)
/dev/sdb9 on /mnt/sdd9 type vfat (rw,noexec,nosuid,nodev,noatime,nodiratime,utf8=true,uid=1000,gid=100)
/dev/sdb14 on /mnt/sdd14 type reiserfs (rw,nosuid,nodev,noatime,nodiratime,user_xattr)
/mnt/sdc4/homedirs/currenthomebase on /home type none (rw,bind)
/mnt/sdd14/ftpupload on /home/ftp type none (rw,bind)
usbfs on /proc/bus/usb type usbfs (rw,noexec,nosuid,devmode=0664,devgid=85)
nfsd on /proc/fs/nfsd type nfsd (rw,noexec,nosuid,nodev)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,noexec,nosuid,nodev)
localhost ~ # fsck -n -v /dev/sdd4
fsck 1.41.4 (27-Jan-2009)
e2fsck 1.41.4 (27-Jan-2009)
Warning!  /dev/sdd4 is mounted.
fsck.ext3: Superblock invalid, trying backup blocks...
/dev/sdd4 was not cleanly unmounted, check forced.
Pass 1: Checking inodes, blocks, and sizes
Inodes that were part of a corrupted orphan linked list found.  Fix? no

Inode 65633 was part of the orphaned inode list.  IGNORED.
Inode 65633 is in use, but has dtime set.  Fix? no

Inode 65633 has imagic flag set.  Clear? no

Inode 65634 was part of the orphaned inode list.  IGNORED.
Inode 65634 is in use, but has dtime set.  Fix? no

Inode 65634 has imagic flag set.  Clear? no

Inode 65635 is in use, but has dtime set.  Fix? no

Inode 65636 is in use, but has dtime set.  Fix? no

Inode 65636 has imagic flag set.  Clear? no

Inode 65637 is in use, but has dtime set.  Fix? no

Inode 65638 was part of the orphaned inode list.  IGNORED.
Inode 65638 is in use, but has dtime set.  Fix? no

Inode 65638 has imagic flag set.  Clear? no

Inode 65639 is in use, but has dtime set.  Fix? no

Inode 65639 has imagic flag set.  Clear? no

Inode 65640 has EXTENTS_FL flag set on filesystem without extents support.
Clear? no

Inode 65640 is in use, but has dtime set.  Fix? no

Inode 65640 has imagic flag set.  Clear? no

Inode 65640 has INDEX_FL flag set but is not a directory.
Clear HTree index? no

Inode 65640 has INDEX_FL flag set on filesystem without htree support.
Clear HTree index? no

HTREE directory inode 65640 has an invalid root node.
Clear HTree index? no

Inode 65640, i_size is 7596555722573572963, should be 0.  Fix? no

Inode 65640, i_blocks is 110442491309673, should be 0.  Fix? no

Inode 65641 was part of the orphaned inode list.  IGNORED.
Inode 65641 is in use, but has dtime set.  Fix? no

Inode 65641 has imagic flag set.  Clear? no

Inode 65642 has EXTENTS_FL flag set on filesystem without extents support.
Clear? no

Inode 65642 was part of the orphaned inode list.  IGNORED.
Inode 65642 is in use, but has dtime set.  Fix? no

Inode 65642 has imagic flag set.  Clear? no

Inode 65642, i_size is 8083519780430375286, should be 0.  Fix? no

Inode 65642, i_blocks is 1635148138, should be 0.  Fix? no

Inode 65643 is in use, but has dtime set.  Fix? no

Inode 65644 has EXTENTS_FL flag set on filesystem without extents support.
Clear? no

Inode 65644 is in use, but has dtime set.  Fix? no

Inode 65644 has imagic flag set.  Clear? no

Inode 65644 has INDEX_FL flag set but is not a directory.
Clear HTree index? no

Inode 65644 has INDEX_FL flag set on filesystem without htree support.
Clear HTree index? no

HTREE directory inode 65644 has an invalid root node.
Clear HTree index? no

Inode 65644, i_size is 7154379643719413353, should be 0.  Fix? no

Inode 65644, i_blocks is 70653980472423, should be 0.  Fix? no

Inode 65645 is in use, but has dtime set.  Fix? no

Inode 65645 has imagic flag set.  Clear? no

Inode 65646 was part of the orphaned inode list.  IGNORED.
Inode 65646 is in use, but has dtime set.  Fix? no

Inode 65646 has imagic flag set.  Clear? no

Inode 65647 is in use, but has dtime set.  Fix? no

Inode 65648 is in use, but has dtime set.  Fix? no

Inode 65648 has imagic flag set.  Clear? no

Inode 65649 has EXTENTS_FL flag set on filesystem without extents support.
Clear? no

Inode 65649 is in use, but has dtime set.  Fix? no

Inode 65649 has imagic flag set.  Clear? no

Inode 65649 has compression flag set on filesystem without compression support.  Clear? no

Inode 65649 has a bad extended attribute block 17973331.  Clear? no

Extended attribute block 17973331 has h_blocks > 1.  Clear? no

Extended attribute block 17973331 is corrupt (invalid value).  Clear? no

Extended attribute block 17973331 is corrupt (invalid value).  Clear? no

Extended attribute block 17973331 is corrupt (allocation collision).  Clear? no

Inode 65649, i_size is 18612260, should be 0.  Fix? no

Inode 65649, i_blocks is 1882092129, should be 8.  Fix? no

Inode 65650 has EXTENTS_FL flag set on filesystem without extents support.
Clear? no

Inode 65650 is in use, but has dtime set.  Fix? no

Inode 65650 has imagic flag set.  Clear? no

Inode 65650 has compression flag set on filesystem without compression support.  Clear? no

Inode 65650 has a bad extended attribute block 18219040.  Clear? no

Extended attribute block 18219040 has h_blocks > 1.  Clear? no

Inode 65650, i_size is 8390010714862010452, should be 0.  Fix? no

Inode 65650, i_blocks is 1882092129, should be 8.  Fix? no

Inode 65651 is in use, but has dtime set.  Fix? no

Inode 65652 is in use, but has dtime set.  Fix? no

Inode 65653 is in use, but has dtime set.  Fix? no

Inode 65653 has imagic flag set.  Clear? no

Inode 65654 was part of the orphaned inode list.  IGNORED.
Inode 65654 is in use, but has dtime set.  Fix? no

Inode 65654 has imagic flag set.  Clear? no

Inode 65655 is in use, but has dtime set.  Fix? no

Inode 65655 has imagic flag set.  Clear? no

Inode 65656 is in use, but has dtime set.  Fix? no

Inode 65656 has imagic flag set.  Clear? no

Inode 65657 was part of the orphaned inode list.  IGNORED.
Inode 65657 is in use, but has dtime set.  Fix? no

Inode 65657 has imagic flag set.  Clear? no

Inode 65658 is in use, but has dtime set.  Fix? no

Inode 65658 has imagic flag set.  Clear? no

Inode 65659 was part of the orphaned inode list.  IGNORED.
Inode 65659 is in use, but has dtime set.  Fix? no

Inode 65659 has imagic flag set.  Clear? no

Inode 65660 is in use, but has dtime set.  Fix? no

Inode 65660 has imagic flag set.  Clear? no

Inode 65661 has EXTENTS_FL flag set on filesystem without extents support.
Clear? no

Inode 65661 is in use, but has dtime set.  Fix? no

Inode 65661, i_size is 3345727465987074388, should be 0.  Fix? no

Inode 65661, i_blocks is 17973465, should be 0.  Fix? no

Inode 65662 is in use, but has dtime set.  Fix? no

Inode 65662 has imagic flag set.  Clear? no

Inode 65663 has EXTENTS_FL flag set on filesystem without extents support.
Clear? no

Inode 65663 was part of the orphaned inode list.  IGNORED.
Inode 65663 is in use, but has dtime set.  Fix? no

Inode 65663 has imagic flag set.  Clear? no

Inode 65663 has compression flag set on filesystem without compression support.  Clear? no

Inode 65663 has INDEX_FL flag set but is not a directory.
Clear HTree index? no

Inode 65663 has INDEX_FL flag set on filesystem without htree support.
Clear HTree index? no

HTREE directory inode 65663 has an invalid root node.
Clear HTree index? no

Inode 65663, i_size is 127961696398416, should be 0.  Fix? no

Inode 65663, i_blocks is 1701999662, should be 0.  Fix? no

Inode 65664 is in use, but has dtime set.  Fix? no

Special (device/socket/fifo) inode 65664 has non-zero size.  Fix? no

Inode 65643, i_size is 7595448759110104174, should be 0.  Fix? no

Inode 65643, i_blocks is 112, should be 0.  Fix? no

Inode 65660, i_size is 7454983851022116211, should be 0.  Fix? no

Inode 65660, i_blocks is 1920233071, should be 0.  Fix? no

Inode 65656, i_size is 7882825952943829038, should be 0.  Fix? no

Inode 65656, i_blocks is 123636965337460, should be 0.  Fix? no

Inode 65637, i_size is 7017855501071644462, should be 0.  Fix? no

Inode 65637, i_blocks is 9650295, should be 0.  Fix? no

Inode 65633, i_size is 8679613453339525132, should be 0.  Fix? no

Inode 65633, i_blocks is 70514807078928, should be 0.  Fix? no

Inode 65653 has compression flag set on filesystem without compression support.  Clear? no

Inode 65653, i_size is 8752868411229487200, should be 0.  Fix? no

Inode 65653, i_blocks is 1852401525, should be 0.  Fix? no

Inode 65638, i_size is 7011336260774359649, should be 0.  Fix? no

Inode 65638, i_blocks is 113752228954172, should be 0.  Fix? no

Inode 65662, i_size is 8100972366817881155, should be 0.  Fix? no

Inode 65662, i_blocks is 51050001334332, should be 0.  Fix? no

Inode 65652 has a bad extended attribute block 18153504.  Clear? no

Extended attribute block 18153504 has h_blocks > 1.  Clear? no

Inode 65652 has illegal block(s).  Clear? no

Illegal block #0 (1885957187) in inode 65652.  IGNORED.
Illegal block #1 (1918988130) in inode 65652.  IGNORED.
Illegal block #2 (1970032740) in inode 65652.  IGNORED.
Illegal block #3 (778987879) in inode 65652.  IGNORED.
Illegal block #4 (779247978) in inode 65652.  IGNORED.
Illegal block #5 (2020569712) in inode 65652.  IGNORED.
Illegal block #9 (1885957187) in inode 65652.  IGNORED.
Illegal block #10 (1918988130) in inode 65652.  IGNORED.
Illegal block #11 (1970032740) in inode 65652.  IGNORED.
Illegal block #-1 (778987879) in inode 65652.  IGNORED.
Illegal block #-2 (1852793705) in inode 65652.  IGNORED.
Too many illegal blocks in inode 65652.
Clear inode? no

Suppress messages? no

Illegal block #-3 (1735290926) in inode 65652.  IGNORED.
Error while iterating over blocks in inode 65652: Illegal triply indirect block found
e2fsck: aborted
localhost ~ # df
Filesystem    Type    Size  Used Avail Use% Mounted on
rootfs      rootfs     33G   31G  351M  99% /
/dev/root     ext4     33G   31G  351M  99% /
rc-svcdir    tmpfs    1.0M  128K  896K  13% /lib64/rc/init.d
udev         tmpfs     10M  288K  9.8M   3% /dev
shm          tmpfs    3.9G     0  3.9G   0% /dev/shm
cachedir     tmpfs     33G   31G  351M  99% /lib64/splash/cache
/dev/sda5     ext2    236M   66M  158M  30% /boot
/dev/sda3     ext4     28G   23G  3.5G  87% /mnt/sda3
/dev/sda4     ext4    396G  268G  109G  72% /mnt/sda4
/dev/sdc1  fuseblk    411G  229G  182G  56% /mnt/sdd1
/dev/sdc2     ext3    514G  389G   99G  80% /mnt/sdd2
/dev/sdb9     vfat     63M  556K   63M   1% /mnt/sdd9
/dev/sdb14
          reiserfs    200G  131G   70G  66% /mnt/sdd14
localhost ~ # mount
rootfs on / type rootfs (rw)
/dev/root on / type ext4 (rw,noatime,nodiratime,barrier=1,data=ordered)
proc on /proc type proc (rw,relatime)
rc-svcdir on /lib64/rc/init.d type tmpfs (rw,nosuid,nodev,noexec,relatime,size=1024k,mode=755)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
debugfs on /sys/kernel/debug type debugfs (rw,nosuid,nodev,noexec,relatime)
udev on /dev type tmpfs (rw,nosuid,relatime,size=10240k,mode=755)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
shm on /dev/shm type tmpfs (rw,nosuid,nodev,noexec,relatime)
cachedir on /lib64/splash/cache type tmpfs (rw,relatime,size=4096k,mode=644)
/dev/sda5 on /boot type ext2 (rw,noatime,nodiratime)
/dev/sda3 on /mnt/sda3 type ext4 (rw,noatime,nodiratime,data=journal)
/dev/sda4 on /mnt/sda4 type ext4 (rw,noatime,nodiratime)
/dev/sdc1 on /mnt/sdd1 type fuseblk (rw,noatime,allow_other,blksize=4096)
/dev/sdc2 on /mnt/sdd2 type ext3 (rw,noatime,nodiratime)
/dev/sdb9 on /mnt/sdd9 type vfat (rw,noexec,nosuid,nodev,noatime,nodiratime,utf8=true,uid=1000,gid=100)
/dev/sdb14 on /mnt/sdd14 type reiserfs (rw,nosuid,nodev,noatime,nodiratime,user_xattr)
/mnt/sdc4/homedirs/currenthomebase on /home type none (rw,bind)
/mnt/sdd14/ftpupload on /home/ftp type none (rw,bind)
usbfs on /proc/bus/usb type usbfs (rw,noexec,nosuid,devmode=0664,devgid=85)
nfsd on /proc/fs/nfsd type nfsd (rw,noexec,nosuid,nodev)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,noexec,nosuid,nodev)
localhost ~ # lsof|grep sdd4
localhost ~ # lsof|grep sdc4
localhost ~ # fsck -p -v /dev/sdd4
fsck 1.41.4 (27-Jan-2009)
/dev/sdd4 is mounted.

WARNING!!!  Running e2fsck on a mounted filesystem may cause
SEVERE filesystem damage.

Do you really want to continue (y/n)? no

check aborted.
localhost ~ # ls /etc/mt
ls: cannot access /etc/mt: No such file or directory
localhost ~ # ls /etc/mtab
-rw-r--r-- 1 root root 1.3K 2009-05-03 00:14 /etc/mtab
localhost ~ # cat /etc/mtab
rootfs / rootfs rw 0 0
/dev/root / ext4 rw,noatime,nodiratime,barrier=1,data=ordered 0 0
proc /proc proc rw,relatime 0 0
rc-svcdir /lib64/rc/init.d tmpfs rw,nosuid,nodev,noexec,relatime,size=1024k,mode=755 0 0
sysfs /sys sysfs rw,nosuid,nodev,noexec,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,nosuid,nodev,noexec,relatime 0 0
udev /dev tmpfs rw,nosuid,relatime,size=10240k,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
shm /dev/shm tmpfs rw,nosuid,nodev,noexec,relatime 0 0
cachedir /lib64/splash/cache tmpfs rw,relatime,size=4096k,mode=644 0 0
/dev/sda5 /boot ext2 rw,noatime,nodiratime 0 0
/dev/sda3 /mnt/sda3 ext4 rw,noatime,nodiratime,data=journal 0 0
/dev/sda4 /mnt/sda4 ext4 rw,noatime,nodiratime 0 0
/dev/sdc1 /mnt/sdd1 fuseblk rw,noatime,allow_other,blksize=4096 0 0
/dev/sdc2 /mnt/sdd2 ext3 rw,noatime,nodiratime 0 0
/dev/sdb9 /mnt/sdd9 vfat rw,noexec,nosuid,nodev,noatime,nodiratime,utf8=true,uid=1000,gid=100 0 0
/dev/sdb14 /mnt/sdd14 reiserfs rw,nosuid,nodev,noatime,nodiratime,user_xattr 0 0
/mnt/sdc4/homedirs/currenthomebase /home none rw,bind 0 0
/mnt/sdd14/ftpupload /home/ftp none rw,bind 0 0
usbfs /proc/bus/usb usbfs rw,noexec,nosuid,devmode=0664,devgid=85 0 0
nfsd /proc/fs/nfsd nfsd rw,noexec,nosuid,nodev 0 0
binfmt_misc /proc/sys/fs/binfmt_misc binfmt_misc rw,noexec,nosuid,nodev 0 0
localhost ~ # umount -v /dev/sdd4
Could not find /dev/sdd4 in mtab
umount: /dev/sdd4: not mounted
localhost ~ # umount -v /dev/sdd4
Could not find /dev/sdd4 in mtab
umount: /dev/sdd4: not mounted
localhost ~ # fsck -p -v /dev/sdd4
fsck 1.41.4 (27-Jan-2009)
/dev/sdd4 is mounted.

WARNING!!!  Running e2fsck on a mounted filesystem may cause
SEVERE filesystem damage.

Do you really want to continue (y/n)? yes

fsck.ext3: Bad magic number in super-block while trying to open /dev/sdd4
/dev/sdd4:
The superblock could not be read or does not describe a correct ext2
filesystem.  If the device is valid and it really contains an ext2
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
    e2fsck -b 8193 <device>

localhost ~ # fsck.ext4 -p -v /dev/sdd4
/dev/sdd4 is mounted.

WARNING!!!  Running e2fsck on a mounted filesystem may cause
SEVERE filesystem damage.

Do you really want to continue (y/n)? yes

fsck.ext4: Bad magic number in super-block while trying to open /dev/sdd4
/dev/sdd4:
The superblock could not be read or does not describe a correct ext2
filesystem.  If the device is valid and it really contains an ext2
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
    e2fsck -b 8193 <device>

localhost ~ # mount -v /dev/sdd4
/dev/sdd4 on /mnt/sdc4 type ext3 (rw,noatime,nodiratime,user_xattr)
localhost ~ # ls /mnt/sdc4/
ls: cannot access /mnt/sdc4/dlf_high.ogg: Input/output error
total 4.0T
drwxrwxrwx    25 zero08           1000     4.0K 2009-04-27 12:17 .
drwxr-xr-x    15 root       root           4.0K 2008-12-30 16:25 ..
[...]


^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: fsck ate my ext4 home partition, help!?
  2009-05-05 20:49     ` Christian Kujau
@ 2009-05-06 13:43       ` Marcel Partap
  2009-05-07  4:01         ` Christian Kujau
  0 siblings, 1 reply; 8+ messages in thread
From: Marcel Partap @ 2009-05-06 13:43 UTC (permalink / raw)
  To: Christian Kujau; +Cc: linux-ext4

Hmm yeah. First attempt issuing a fsck.ext3 -yv /dev/sdd4 resulted in a lost+found frenzy - everything under the former directory /mnt/sdc4/homedirs/currenthomebase (which was mounted under /home) got relinked into lost+found with sequential numbers... Not bad, the data is there - but this is quite unusable iykwim..

> Now that you have a backup copy, I'd suggest to get that "but sdd4 is
> mounted" error out of the way and try to e2fsck with a different 
> superblock.

Uhmm, well. So i again dded the backup image to the partition, ran mkfs.ext3 -nv /dev/sdd4 to get a list of the FS's backup superblocks, then tried to see if any of them is in a better state than the original one by doing
> for blockpos in 32768 98304 163840 229376 294912 819200 884736 1605632
> 2654208 4096000 7962624 11239424 20480000 23887872; do fsck.ext3 -vnb
> $blockpos /dev/sdd4 > fsck-$blockpos.log; done
and then comparing those output files. Unfortunately, all show the same resulting output meaning there is no benefit from using them. A script i found @ http://blog.windfluechter.net/index.php?/archives/307-Automatically-restore-files-from-lost+found-improved.html which can move objects back in place from lost+found has to backup all filenames BEFORE running into this situation so is not of great help at this point..

Oh and this extundelete tool - i couldn't quite put it to the test because as soon as i let it loose on the partition - well it quickly eats up all memory causing the oom_killer to terminate it.

Force-mounting the partition _without_ repairing it just results in an empty mount point.

Ain't there no alternative way to reconstruct the directory structure, it surely can't be overwritten completely...??
regards marcel.
-- 
Psssst! Schon vom neuen GMX MultiMessenger gehört? Der kann`s mit allen: http://www.gmx.net/de/go/multimessenger01
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: fsck ate my ext4 home partition, help!?
  2009-05-06 13:43       ` Marcel Partap
@ 2009-05-07  4:01         ` Christian Kujau
  0 siblings, 0 replies; 8+ messages in thread
From: Christian Kujau @ 2009-05-07  4:01 UTC (permalink / raw)
  To: Marcel Partap; +Cc: linux-ext4

On Wed, 6 May 2009, Marcel Partap wrote:
> Oh and this extundelete tool - i couldn't quite put it
> to the test because as soon as i let it loose on the partition - well it 
> quickly eats up all memory causing the oom_killer to terminate it.

There are more "undelete" tools listed in the wiki: 
http://ext4.wiki.kernel.org/index.php/Undeletion

...but the results may not be perfect, to say the least.

Christian.
-- 
Bruce Schneier doesn't keep secrets -- they keep themselves out of fear.

^ permalink raw reply	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2009-05-07  4:01 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2009-05-04 13:11 fsck ate my ext4 home partition, help!? Marcel Partap
2009-05-05  5:33 ` Christian Kujau
2009-05-05 14:44   ` Marcel Partap
2009-05-05 16:51     ` Andreas Dilger
2009-05-05 20:49     ` Christian Kujau
2009-05-06 13:43       ` Marcel Partap
2009-05-07  4:01         ` Christian Kujau
2009-05-05 15:06   ` Marcel Partap

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.