[Nottingham] Filesystem Death

[Philip Scott]

Greetings all, 

As you may have guessed from the subject, I am having a few troubles with my 
100Gb ext2 partition. I suspect it was caused by a multitude of spontanious 
restarts due to fan failure inside my PC :)

First of all, the obvious:
# e2fsck /dev/hda4
e2fsck 1.34 (25-Jul-2003)
/dev/hda4 was not cleanly unmounted, check forced.
Pass 1: Checking inodes, blocks, and sizes
Bad block 0 used as bad block indirect block?!?

This inconsistency can not be fixed with e2fsck; to fix it, use
dumpe2fs -b to dump out the bad block list and e2fsck -L filename
to read it back in again.
Continue<y>?

Doing what it tells me is fruitless; calling fsck with any options that make 
it think about bad blocks (-l, -L, -c) cause it to die with the error

# e2fsck -c /dev/hda4
e2fsck 1.34 (25-Jul-2003)
ext2fs_block_iterate: Ext2 file too big while sanity checking the bad blocks 
inode

So I fear that the bad blocks block might be broken - so as any sensible 
person would do, out comes debugfs:

debugfs:  cd /
/: Ext2 inode is not a directory

Which is a bit of a bummer ;) Investigating further - 

debugfs:  stat /
Inode: 2   Type: bad type    Mode:  0401   Flags: 0x1010101   Generation: 
168430
09
User:   257   Group:   257   Size: 16843009
File ACL: 16843009    Directory ACL: 0
Links: 0   Blockcount: 16843009
Fragment:  Address: 16843009    Number: 1    Size: 1
ctime: 0x01010101 -- Tue Jul 14 23:36:49 1970
atime: 0x01010101 -- Tue Jul 14 23:36:49 1970
mtime: 0x01010101 -- Tue Jul 14 23:36:49 1970
dtime: 0x3fbbd454 -- Wed Nov 19 20:36:36 2003
BLOCKS:
(0):16843009, (1):16843009, (2):16843009, (3):16843009, (4):16843009, 
(5):168430
09, (6):16843009, (7):16843009, (8):16843009, (9):16843009, (10):16843009, 
(11):
16843009, (IND):16843009, (DIND):16843009, (TIND):16843009
TOTAL: 15

Which doesn't appear to make much sense - user/group 257 do not exist on my 
system, {a|c|m} time are all nonsensical, the type is invalid - yet dtime 
appears to be correct, perhaps this is something added by fsck after it was 
corrupted. So anyhow, I think we can safely say my root inode has said its 
farewells to this world; I an not that fussed about that - but there is one 
directory, /pub, I would really rather get back. My question is this, is it 
possible in any way to hunt down the respective inode and replace the root 
inode with it, so that I can get at my stuff? Unfortunatly I am not overly 
familiar with ext2 internals, so I do not quite know where to go from here..

Any advice would be warmly welcomed!

Kind regards,
        Philip