			A few disc recovery tools

		   Richard Gooch <rgooch@atnf.csiro.au>


These are just a few tools I put together over a weekend in response
to a fatal disc failure on my main machine. I found that I was no
longer able to mount my ext2 filesystem (I got a kernel panic and had
to hit reset). I was able to access most (94.6%) of the blocks on my
disc if I bypassed the filesystem and read the partition.

The first programme <copy_blocks> allows you to copy the contents of a
partition and write it out to an ordinary file. Any blocks it can't
access because of I/O errors (i.e. bad blocks) are just written to the
file as zeros. It also logs all the blocks it could not read (for
later use).

Sometimes, a second pass over the disc will allow you to access some
of the blocks you originally could not (this happens if your disc is
just on the brink of dying permanently). You can use the
<copy_listed_blocks> programme to use the logfile that <copy_blocks>
produces to attempt to recover more blocks. Good luck.

Once you have your filesystem image safely on a good disc, you can run
the <debugfs> programme which is available from the e2fsprogs
package. Even if your important files were on good blocks, life is
still a bit difficult if parts of your directory structure were on bad
blocks. While <debugfs> allows you to manually extract individual
inodes, this can be a bit painful. This is where you use the
<e2fsfind> programme, which allows you to define search criteria (such
as minimum filesize, minimum age substrings and so on), and then
extract all files which match the criteria. It doesn't care if
directories are corrupted or not.

If you are really unlucky, your inode table is corrupted, and then all
you can do is use an editor on the filesystem image file and look for
known keywords in your files. You then have to piece together the
fragmented files. The <e2fsfind> programme won't help you here.


And for those who are wondering how my data recovery went: these
programmes saved my bacon! I was really dreading using emacs on a 1.7
GByte filesystem image.
