# rescue ext3 filesystem [solved]

## KKtm

I accidentaly reformated my ext3-data-partition as swap.

The problem is because sda6 was shown (already before reformatting) as swap space although it was ext3. In fact the ext3-partition isn't even shown at all in fdisk, whereas parted sees it.

```

Disk /dev/sda: 250.0 GB, 250059350016 bytes

255 heads, 63 sectors/track, 30401 cylinders

Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System

/dev/sda1               1           5       40131   83  Linux

Partition 1 does not end on cylinder boundary.

/dev/sda2   *           6        3836    30761640    7  HPFS/NTFS

Partition 2 does not end on cylinder boundary.

/dev/sda3            3837       30401   213383362+   f  W95 Ext'd (LBA)

Partition 3 does not end on cylinder boundary.

/dev/sda5            3838        7661    30716248+  83  Linux

/dev/sda6           30275       30401     1020096   82  Linux swap / Solaris

```

```
Welcome to GNU Parted! Type 'help' to view a list of commands.

(parted) print

Disk /dev/sda: 250GB

Sector size (logical/physical): 512B/512B

Partition Table: msdos

Number  Start   End     Size    Type      File system  Flags

 1      32.3kB  41.1MB  41.1MB  primary   reiserfs

 2      46.4MB  31.5GB  31.5GB  primary   ntfs         boot

 3      31.6GB  250GB   219GB   extended               lba

 5      31.6GB  63.0GB  31.5GB  logical   reiserfs

 6      63.0GB  249GB   186GB   logical   linux-swap

 7      249GB   250GB   1045MB  logical   linux-swap

```

pretty strange, nevertheless, the accident happened.

Now I'd really like to get my data back (I'm sure they're not deleted, mkswap only took half a second and that's not enough to delete a 186GB partition).

Any recommandation which program could help me?Last edited by KKtm on Sun Nov 26, 2006 5:12 pm; edited 1 time in total

----------

## NeddySeagoon

KKtm,

You are right about most of your data still being on the drive. mkswap writes a few blocks at the beginning of the partition, where the ext3 superblock was. If you are really lucky, thats all that was destroyed, which is ok as ext3 keeps backup superblocks. However, you may of lost the free space map (or part of it) too, which means that its safe to try to use an alternate superblock to mount the partition read only but you must copy the data off, someplace. Either that, or see how much of your ext3 mkswap trampled over. You really don't want your used blocks marked as free. 

man e2fsck says 

```
For  filesystems  with  1k  blocksizes,  a   backup

              superblock  can  be found at block 8193; for filesystems with 2k

              blocksizes, at block 16384; and  for  4k  blocksizes,  at  block

              32768.
```

 and man mount tells about the 

```
sb= oprion  sb=n   Instead of block 1, use block n as  superblock ...  The block number here  uses  1k

              units.  Thus,  if  you  want  to  use  logical  block 32768 on a

              filesystem with 4k blocks, use "sb=131072"
```

Putting that together 

```
mount -o ro,sb=131072 /dev/sda6 /mnt/someplace
```

is well worth trying. If that fails, there are other superblock copies too. If the damage means you have lost the filesystem root directory, you need at least one copy of the partition to play with.

----------

## KKtm

Thanks alot.

The filesystem was /home so the root directory is still ok, the system boots normal and I created a new home on the root partition, to be able to get back into my desktop environment.

I've tried 

```
mount -o ro,sb=131072 /dev/sda6 /mnt/temp/
```

but I got 

```
/dev/sda6 looks like swapspace - not mounted

mount: you must specify the filesystem type

```

Any more ideas?

----------

## NeddySeagoon

KKtm,

```
mount -o ro,sb=131072 -t ext3 /dev/sda6 /mnt/temp/
```

 Tell mount its actually ext3.

If the startup sequence has /dev/sda6 already mounted as swap (since it has a valid swap signature) you may need to do

```
swapoff /dev/sda6
```

first.

You can discover more alternate superblocks with 

```
mke2fs -n -j /dev/sda6
```

Now, thats a very dangerous thing to do, since one error on your part will remake a whole new filesystem. Read about -n in 

```
man mke2fs 
```

 Try some other alternate superblocks.

There is also debugfs and sleuthkit, you probably have debugfs already. Sleuthkit is in portage.

debugfs is intended for filesystem developers, is advertised as such in its man page.

What I said about the root directory of the filesystem being destroyed, I was meaning the top level directory on /dev/sda6, whatever its was. Not the kernels root directory.

----------

## KKtm

Thank you so much   :Very Happy:  It worked right away with -t ext3!

I'm now tar-ing it to the root file-system and reformatting the partition (and hope this time it'll be shown in fdisk as well)

btw: does 

```
Partition 1 does not end on cylinder boundary. 
```

 that somehow affect my partitioning scheme?

----------

## NeddySeagoon

KKtm,

I'm glad it was that easy.

Historically, PCs always made partitions start and end on a disk cylinder boundary (other than the first partition)

When Cylinder/Head/Sector addressing could no longer be used because it cannot address more than 8Gb the concept of cylinders was lost, since Logical Block Addressing sees the drive as a sequence of blocks. As drives grew, the concept CHS  became more blurred because differen zones on the drive had  different numbers of sectors per track.

In short, if you don't install an OS that uses C/H/S addressing, e.g. DOS, Win31, Win95  it doesn't matter.

For the full history lesson google The Large Disk HOWTO.

----------

