1

Good day, yesterday I tried to extend my swap partition ('cause suspend/hibernation didn't work) and I needed to decrease size of my debian linux disk (I don't ever remember if it was ext2/et3 or what), I used Parted and waited about 1 hour until it was moving data to 'right', okay, it still didn't work so I wanted to get back to status quo, it said it was moving data to 'left' and I canceled resizing. Then my partition became unknown. I was browsing forums and etc. and found I can restore previous state from superblock. However it didn't work 'cause it always threw out it didn't recognize it was linux disk.

Then I (accidentally) ran some sort of e2fsck or mkfs (I don't remember) and it probably has overwritten my old superblock and there became an ext3 partition with 1 folder (lost+found).

logs from TestDisk:

Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63

 Partition                  Start        End    Size in sectors

Linux 3378 167 54 7981 199 26 73949184 superblock 0, blocksize=4096 [] superblock 32768, blocksize=4096 [] superblock 98304, blocksize=4096 [] superblock 163840, blocksize=4096 [] superblock 229376, blocksize=4096 [] superblock 294912, blocksize=4096 [] superblock 819200, blocksize=4096 [] superblock 884736, blocksize=4096 [] superblock 1605632, blocksize=4096 [] superblock 2654208, blocksize=4096 []

To repair the filesystem using alternate superblock, run fsck.ext3 -p -b superblock -B blocksize device

Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63

Partition                  Start        End    Size in sectors

1 P Windows RE(store) 0 32 33 191 89 26 3072000 2 * HPFS - NTFS 191 89 27 3378 102 52 51200000 [XP] 3 E extended LBA 3378 135 20 9133 116 7 92452866 5 L Linux 3378 167 54 7981 199 26 73949184 X extended 7981 199 27 9020 161 37 16689152 6 L Linux Swap 7981 231 59 9020 161 37 16687104 4 P HPFS - NTFS 11807 35 5 19456 243 51 122894336 [WIN7]

root@partedmagic:~# dumpe2fs /dev/sda5 | grep -i superblock dumpe2fs 1.42.6 (21-Sep-2012) Primary superblock at 0, Group descriptors at 1-3 Backup superblock at 32768, Group descriptors at 32769-32771 Backup superblock at 98304, Group descriptors at 98305-98307 Backup superblock at 163840, Group descriptors at 163841-163843 Backup superblock at 229376, Group descriptors at 229377-229379 Backup superblock at 294912, Group descriptors at 294913-294915 Backup superblock at 819200, Group descriptors at 819201-819203 Backup superblock at 884736, Group descriptors at 884737-884739 Backup superblock at 1605632, Group descriptors at 1605633-1605635 Backup superblock at 2654208, Group descriptors at 2654209-2654211 Backup superblock at 4096000, Group descriptors at 4096001-4096003 Backup superblock at 7962624, Group descriptors at 7962625-7962627

When I try to use any backup superblock:

root@partedmagic:~# e2fsck -y -f -v -c -b 884736 /dev/sda5 e2fsck 1.42.6 (21-Sep-2012) Checking for bad blocks (read-only test): done

/dev/sda5: Updating bad block inode. Pass 1: Checking inodes, blocks, and sizes Pass 2: Checking directory structure Pass 3: Checking directory connectivity Pass 4: Checking reference counts Pass 5: Checking group summary information

/dev/sda5: ***** FILE SYSTEM WAS MODIFIED *****

      11 inodes used (0.00%, out of 2313808)
       0 non-contiguous files (0.0%)
       0 non-contiguous directories (0.0%)
         # of inodes with ind/dind/tind blocks: 0/0/0
  190286 blocks used (2.06%, out of 9243648)
       0 bad blocks
       1 large file

       0 regular files
       2 directories
       0 character device files
       0 block device files
       0 fifos
       0 links
       0 symbolic links (0 fast symbolic links)

0 sockets

       2 files

root@partedmagic:~#

I seen someone recovered data with no structure and found them all in

lost+found folder by combination of these commands (maybe mke2fsm

e2fsck, tune2fs), please, advice me something to recover atleast data,

if it is possible. (I tried to use PhotoRec and Autopsy yet).

I also have a dd backup from TestDisk (unfortunately, one after I ran that e2fsck command), can I recover some data from that backup? How do I recover state of backup onge again to /dev/sda5?

Thank you. (Sorry for poor formatting and english.)

  • PhotoRec is your best bet as an immediate measure. For the filesystem itself, even not considering the damage you already did with your own repair attempts, you'd have to know the exact progress of the partition move. – frostschutz Mar 28 '15 at 11:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.