![]() | Note |
---|---|
The information below only applies to ext2 and ext3 file systems. If you have a different file system, please check its documentation. |
The super-block is the first block of each ext2FS/ext3FS partition. It contains important data about the file system, such as its size, free space, etc. (it is similar to the method used by FAT partitions). A partition with a damaged super-block cannot be mounted. Fortunately, ext2FS/ext3FS keeps several super-block backup copies scattered over the partition.
Boot your system
with a boot disk. The backup copies' location depends on the block
size of the file system. For file systems with 1 KB block
sizes it is at the beginning of each 8 KB (8192 bytes)
block. For file systems with 2 KB sizes it is at the
beginning of each 16 KB (16384 bytes) block, and so on. You
can use the mke2fs -n [your_disk_device_name]
command to find out at which byte positions the super-block copies
are. Assuming a 1 KB block size, the first backup copy is
in byte number 8193. To restore the super-block from this copy,
execute e2fsck -b 8193 /dev/hda4; change
hda4
accordingly to reflect the name of your
damaged partition. If that block also happens to be damaged, try
the next one at byte number 16385, and so on until you find a
suitable one. Reboot your system to activate the changes.
Abstract
We will discuss some ways of recovering deleted files and directories. Please bear in mind that recovery tools are not magical, and they will only work depending on how recently you deleted the file(s) you are trying to recover.
You might be wondering how to recover files you accidentally deleted. There are some utilities designed for GNU/Linux's ext2 file system which allow you to recover deleted files and directories. However they won't recover the files you deleted a few months ago because of disk usage, space marked as “free” will have been overwritten. So the best way to protect against accidental or not so accidental deletions is by making backups.
![]() | Note |
---|---|
Please bear in mind that there are not (as yet) tools to recover files deleted on reiserfs file systems. Keep in touch with the ReiserFS home page for the latest news about it. |
One recovery tool
is Recover. It's an interactive
tool. If you have a Mandrakelinux –– PowerPack Edition™, you already have it on
the contribs
CD-ROM. Otherwise, you can find
it on the Rpmfind web
site. Go there and download the RPM. Once you have the
RPM, install it. Then run it with recover
and answer the questions it asks you. The questions will help you
to set a time span to look for deleted files and directories to
minimize the time it takes to do the search[21].
Once the tool finishes its search, it will ask you where you want to save the recovered files and directories. Pick a directory of your choice, and you will have all the files and directories recovered into it. Note that you won't be able to recover the file names, just their contents, but you can inspect them or try to rename them with different names until you get the right one. This is better than nothing.
![]() | Note |
---|---|
There are also
mini- |
[21] You can search for
all deleted files too by appending the
-a
option, but it will take
longer...