1

The root inode and journal have both been wiped from my ext4 filesystem accidentally when I zeroed the first few megabytes of my partition. My data, however, has all been successfully recovered with photorec. Is it possible for me to recover anything besides just the raw data? Any filenames? metadata? Or is all of that stuff typically stored in the beginning of the disk partition?

1

Running e2fsck is normally the best way to recover a filesystem, and it can do a remarkably good job even if part of the filesystem is missing. This is because ext2/3/4 use a relatively static layout for filesystem metadata (inodes, bitmaps, etc., though not directories), and has redundant copies of the superblock and critical group descriptor tables in multiple places in the filesystem.

Depending on how (and when) your filesystem was formatted, the start of the filesystem may not contain a lot of critical information at the start beyond the root inode itself. There may be a lot of inodes in that first group, but they are often unused if the filesystem is not full. The e2fsck run will put any in-use files and directories that it finds that do not have a directory entry (which holds the filename) into the lost+found directory. These files and directories will be named like #1234, but you may be able to identify them by their content, UID, GID and move them to the appropriate place in the filesystem (possibly after recreating the parent directories).

More complex tools like ext3grep can potentially recover some more information (if you have an older ext3 filesystem, since it hasn't been updated recently), such as directory blocks, but since the whole start of the filesystem was erased there are limits to what can be recovered.

0

Filenames etc. are spread across the disk in inodes, so they (most of them, some might have been in the part zeroed) should still be around.

How to find them is another matter. When the root inode is lost, I don't think there's any way to find out which blocks contain inodes, that means you're left with programs that read raw blocks of data and guesses which ones are what, and inodes are probably hard to identify, I have no idea if any program can do that (I haven't heard of it).

  • are you sure that inodes contain the filenames? ext4 fsck has been able to find the inodes that havent been deleted without any issue -- the problem has been that the journal and root inodes are gone, so i canno reconstruct the filesystem in the way that something like testdisk suggests. ive read that the inodes do not contain filenames, and that those are stored elsewhere – pepperdreamteam Mar 28 '18 at 7:56
  • 1
    You're right filenames are not in the inodes, but in the directory structure, but as that is also spread across the disc, the point of the rest stands. – Henrik Mar 28 '18 at 8:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.