-1

I have a ~450 gigabyte ext4 filesystem, located at /dev/sda5 on my computer. The partition it resided in, however, was about a gigabyte bigger. So I used the command e2image -ra -p -O XXXX to move the filesystem to the left, so I could use the extra gigabyte on a partition at /dev/sda6. I didn't run that exact command, of course, I forget the decimal value after -O (I didn't run these commands manually, this was done by GParted). e2image got forcefully killed (signal nine) about 100/170 gigabytes through the process. I mounted sda5 read-only, and got many errors about invalid inodes and bad structure files when I tried to access various files or list various directories. So I ran fsck (which I now realize probably damaged things further), and directories like /home and /run (which probably the contained the most data on the whole partition), which I wasn't able to run ls in succesfully, and got lots of error messages about, were non-existent. I ran grep on sda5, and found various files in /home still intact, but I couldn't access them normally because /home was deleted by fsck. How can I recover files without manually searching for them with grep, less, or a hex editor? I have very important files I need to get back.

  • Please list the the exact commands you ran, "moving a partition" doesn't really tell much what has been done here. Also, the ext4 mailinglists may be useful too. – ckujau Nov 22 '16 at 22:23
  • @ckujau I do not remember what command GParted used. – Billy Nov 23 '16 at 17:16
  • @ckujau Something like e2image -ra -p -O 123456 /dev/sda5 – Billy Nov 23 '16 at 21:02
  • 1
    You have comprehensively destroyed your filesystem. For future reference, you might like to take away a couple of lessons: always take a backup before performing major surgery on a filesystem, and don't use SIGKILL needlessly. :( – roaima Nov 23 '16 at 22:28
  • 1
    Whatever recovery steps you try, please first make an image (copy) of the entire disk. – derobert Nov 28 '16 at 17:39
1
+100

I think the commenters are right that your file system is pretty well broken. I once accidentally wrote /dev/zero to my main hard drive (while operating) for about half a second before killing it. I was able to use Photorec (http://www.cgsecurity.org/wiki/PhotoRec) to recover my partition table (pretty much automagically) and I am still using that system.

I think you should take a look at Photorec, since it is open-source (yeah!), and because it reads directly from the disk (ignoring the filesystem), so I suspect it might easily save you many hours of searching for files manually.

Also, The commenter who says image your current, messed-up hard drive right now is definitely correct

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.