-1

I have a ~450 gigabyte ext4 filesystem, located at /dev/sda5 on my computer. The partition it resided in, however, was about a gigabyte bigger. So I used the command e2image -ra -p -O XXXX to move the filesystem to the left, so I could use the extra gigabyte on a partition at /dev/sda6. I didn't run that exact command, of course, I forget the decimal value after -O (I didn't run these commands manually, this was done by GParted). e2image got forcefully killed (signal nine) about 100/170 gigabytes through the process. I mounted sda5 read-only, and got many errors about invalid inodes and bad structure files when I tried to access various files or list various directories. So I ran fsck (which I now realize probably damaged things further), and directories like /home and /run (which probably the contained the most data on the whole partition), which I wasn't able to run ls in succesfully, and got lots of error messages about, were non-existent. I ran grep on sda5, and found various files in /home still intact, but I couldn't access them normally because /home was deleted by fsck. How can I recover files without manually searching for them with grep, less, or a hex editor? I have very important files I need to get back.

6
  • Please list the the exact commands you ran, "moving a partition" doesn't really tell much what has been done here. Also, the ext4 mailinglists may be useful too.
    – ckujau
    Nov 22, 2016 at 22:23
  • @ckujau I do not remember what command GParted used.
    – Billy
    Nov 23, 2016 at 17:16
  • @ckujau Something like e2image -ra -p -O 123456 /dev/sda5
    – Billy
    Nov 23, 2016 at 21:02
  • 1
    You have comprehensively destroyed your filesystem. For future reference, you might like to take away a couple of lessons: always take a backup before performing major surgery on a filesystem, and don't use SIGKILL needlessly. :( Nov 23, 2016 at 22:28
  • 1
    Whatever recovery steps you try, please first make an image (copy) of the entire disk.
    – derobert
    Nov 28, 2016 at 17:39

1 Answer 1

1
+100

I think the commenters are right that your file system is pretty well broken. I once accidentally wrote /dev/zero to my main hard drive (while operating) for about half a second before killing it. I was able to use Photorec (http://www.cgsecurity.org/wiki/PhotoRec) to recover my partition table (pretty much automagically) and I am still using that system.

I think you should take a look at Photorec, since it is open-source (yeah!), and because it reads directly from the disk (ignoring the filesystem), so I suspect it might easily save you many hours of searching for files manually.

Also, The commenter who says image your current, messed-up hard drive right now is definitely correct

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .