[sclug] ext2 disaster recovery

[lug at assursys.co.uk]

On Tue, 29 Apr 2003, Will Dickson wrote:

> Hi all,
> 
> I've just had a power brownout which took down my server for about half 
>     a second. Now the root filesystem won't fsck.
> 
> Unfortunately, there are some important files on there, for which my 
> backups are rather badly out of date :-(.
> 
> I have a linux workstn which fortunately wasn't affected, so I can move 
> the drive containing the corrupt filesystem onto that as a secondary drive.
> 
> My questions are:
> 
> 1. How do you mount a known-bad filesystem, i.e. force it to mount 
> read-only without trying to fsck?

mount -t ext2 -o ro /dev/hdxx /mnt/tmpmnt

If it mounts at all.

> 2. Are there any tips / tricks / hacks for this kind of situation?

The Coroner's Toolkit <http://www.porcupine.org/forensics/tct.html> might be
a handy place to start. It's intended for post-intrusion forensics, but it
should also do a reasonable job of salvaging files from a shredded fs. ;-]

> 3. What's the situation with ext3 these days? The last time I read about 
> it, it was considered not quite ready for production use, but that was
> a while ago.

I've been using ext3 for about a couple of years now. Never had a problem
with it.

> Am I correct in thinking that if I'd had ext3 rather than 
> ext2 I wouldn't be in this mess?

Maybe, maybe not. ext3 won't prevent files from getting corrupted (because
they're half-written, or because disc blocks got damaged) but the filesystem
metadata (directory contents, date, time, etc) should always be sane, if not
as up-to-date as you might expect.

> All help gratefully received!
> Will.

Best Regards,
Alex.
-- 
Alex Butcher        Brainbench MVP for Internet Security: www.brainbench.com
Bristol, UK                        Need reliable and secure network systems?
PGP/GnuPG ID:0x271fd950                           <http://www.assursys.com/>