0

I have a rather complicated data recovery task. I want to get some metadata (filenames, directory structure etc.) out of a corrupted ext4 filesystem. I tried a bunch of tools (Testdisk, fsck, foremost) with no avail. I probably didn't use most of them very effectively as I only have an elementary understanding of filesystems. Or maybe these tools weren't the right ones for my situation. This is how I messed everything up:

I have a hard disk drive that I accidentally started an over-write process on. I used one of these SATA USB docking stations, and while handling it I accidentally pressed the clone button. This started a clone from one drive to the other. It created a new partition on my HDD and started to write data on it. I realized this about a minute later and stopped the process and disconnected the drive.

Both disks were formatted with one ext4 partition each. So the partition on one of my disks were destroyed, and now I cannot access the data on it. I know the data that got over-written is probably impossible to recover, but most of the data wouldn't be touched in that short amount of time.

Luckily most of the files I had can be found elsewhere on the internet, so I can download them again. But I need to get a list of file and directory names in order to do that. I couldn't find a tool that does that successfully. Testdisk seemed promising but with it I could only access the data that was created in the clone process. Could anyone tell me how I could accomplish this? I would appreciate any help, thanks.

  • Before you continue, please create an image of the disk using dd so you won't have to experiment on the actual disk! – hedgie Mar 23 at 1:05
0

If you download the e2fsprogs source you can build the findsuper tool to scan the disk to find superblocks on the disk. You should be able to find two different superblock UUIDs - those from the clone copy at the start of the disk, and those from the old filesystem at the end of the disk.

If you run e2fsck with a superblock from the old filesystem, it may be able to recover more of the filesystem, if e.g. the old journal blocks can be recovered back into the filesystem.

In any case, e2fsck (preferably run on a backup image on the disk) will link all the files it can find into lost+found since the root directory at the start of the disk is certainly overwritten.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.