[linuxkernelnewbies] e2salvage

Tue, 21 Apr 2009 16:21:46 -0700

http://e2salvage.sourceforge.net/

e2salvage

e2salvage is a utility which tries to do in-place data recovery a from damaged ext2 filesystems. Unlike e2fsck, it does not look for the data at particular places and it don't tend to believe the data it finds; thus it can handle much more damaged filesystem.

e2salvage tries its best to recover the directory structure of the filesystem, if this fails lost files will be linked to root.

e2salvage is still an experimental piece of software - it can do a lot of harm to your filesystem - only run it on a backup of the damaged filesystem to be safe!

Authors
News
06.10.2003 Released slightly updated v. 0.0.8a
30.09.2003 Site moved to sourceforge.net
Resources

Documentation

Utilities

  • SMART - graphical data recovery tool (not open or free), bootable Linux image seems to be availble here.
  • The Sleuth Kit - a collection of tools for data analysis and disaster recovery including the GUI Autopsy Browser
  • Foremost - A data recovery tool based on data carving, a process in which the disk (or image) is searched for the begining and end of specific file formats (instead of analyzing the structure or meta data of the filesystem). More info in this Sys Admin Magazine article.
  • e2fsprogs - Filesystem utilities for ext2
  • Linux disk editor - graphical disk editor
  • Testdisk - check and undelete partitions
  • e2retrieve - A tool to retrieve files to a different filesystem than the damaged
  • e2extract - A colection of scripts that function similar to e2retrieve.
Linux LVMs with broken disks

Salvaging data on an Linux LVM with all disks working is straight forward: since the filesystem appears as one. However as disk fails it gets more complicated (at least if it is not internally replicated via RAID techniques).

Depending on where the interesting data is stored several options exists. Logical volumes that don't touch the broken disk should be salvagable using vgbackup/restore. For LVs that span the broken disks the answer is slightly more complicated: data on the broken disk will of course be lost, but the remaining disks might contain salvageable data.

To salvage data on volumes that span the broken disk the best shot is the LVM2 partial mode. LVM2 requires the device-mapper which is available either as a patch for Linux kernel 2.4 or included in Linux kernel 2.6. LVM2 is backwards compatible and giving the "--partial" flag to the new tools should enable you to manipulate your LVM even with broken disks. The partial mode relies on a special "ioerror" device which needs to be setup manually Florian Hinzmann has posted a short cookbook on how to do this on the linux-lvm list: here and here (local copies here and here). The device-mapper patch is available from Sistina or as the Debian package "kernel-patch-device-mapper".

After theLVv's are up and running again you should in principle be able to use any recovery tool to restore your data. E2salvage doesn't pay any attention to the broken disks and some files will be garbled (since the data is lost), e2retrieve promises to take special care of broken LVM's.

Mailinglists

e2salvage-user

General e2salvage discussion (compilation problems, usage problems, etc.)

e2salvage-devel

Development related discussion (bug reports, etc.)
TODO
At the time of writing e2salvage is at a rather experimental level. It might help you, but it might make a bad situation worse. Use it with care. Here are some of the challenges to be solved:
  • Rewrite - current codebase is a mess
  • Search for "lost" files - meaning traverse the directory tree and look for files and directories that cannot be reached from the directory tree.
  • When allocating new blocs during salvaging these blocks do not seem to be marked as used.
  • Make use of more elaborate data structures that enables more clever searches than linear (trees, hash tables, ...).
  • Merge Finding inodes and finding directories into one step - two passes over the entire filesystem is slow!
  • Handle partial LVMs - meaning just skipping broken parts.
  • Copy the corrected filesystem structure to a different filesystem rather than try to repair. It should be rather straightforward to traverse the file-tree and copy all files.

Reply via email to