Ext3 users - Nov 2006 - Best Practices for Data Recovery for corrupted EXT2/3?

Hey all..

I had a bad IDE controller that hosed my EXT3 filesystems.  A resulting fsck 
damaged pat of the filesystem and the root inode is gone (on my main drive 
AND the backup drive).   I immediately DD'd the main drive over to an 
identical drive that I have been working on.  But every time.. a fsck 
destroys all the data (moves everything to lost+found) and nothing that I've
found is able to restore the dir structure... or allow me to superposition 
any of the subdirs (such as /home/*).

I've tried testdisk, dd_recover, and Autopsy.. mounting and fsking with 
alternate superblocks, all with no success. 

I would like to retain file names.. as I see that SOME filename/dir structure 
is intact when the fsck starts nuking all my files that don't have a parent 
dir (e.g. ../home/user/file1 --> lost+found).  Is there a way that this 
information can be salvaged?  Or a new fake root inode be slid into place and 
all the links associated?

My last ditch effort will be to allow the migration to lost+found and then try 
to copy off files based on UID/GID/date, but I would really like to retain 
file names. 

Any related into would be useful... but my hopes are not high.

Tweeks

On Tue, Nov 28, 2006 at 10:58:09AM -0600, Thomas Weeks
wrote:
> 
> I had a bad IDE controller that hosed my EXT3 filesystems.  A resulting
fsck
> damaged pat of the filesystem and the root inode is gone (on my main drive 
> AND the backup drive).   I immediately DD'd the main drive over to an 
> identical drive that I have been working on.  But every time.. a fsck 
> destroys all the data (moves everything to lost+found) and nothing that
I've
> found is able to restore the dir structure... or allow me to superposition 
> any of the subdirs (such as /home/*).
Unfortunately, if the root inode is gone, you've lost the names of the
inodes in the root directory.  Usually though most of the inodes in
the root directory are directories, and so the directory hierarchy is
moved to lost+found.  So if you see a directory /lost+found/#5612 that
has files such as /lost+found/#5612/passwd and /lost+found/#5612/motd,
then you could probably guess that #5612 was /etc, and you could then
just move /lost+found/#5612 to /etc.  

Of course, if more of the filesystem than just the root directory is
gone, then you may have lost more directory information and so things
might be not be quite that simple to recover from.
> I would like to retain file names.. as I see that SOME filename/dir
structure
> is intact when the fsck starts nuking all my files that don't have a
parent
> dir (e.g. ../home/user/file1 --> lost+found).  Is there a way that this 
> information can be salvaged?  Or a new fake root inode be slid into place
and
> all the links associated?
It's not that fsck is nuking the names --- the names were gone from
your hardware corruption.  Fsck is seeing that inode doesn't have a
name, which is why it is moving it to /lost+found so you at least
don't lose the data.  Please don't blame fsck; it's doing the best
job
that it can!
> My last ditch effort will be to allow the migration to lost+found and then
try
> to copy off files based on UID/GID/date, but I would really like to retain 
> file names. 
Sorry, the file names are gone; if they were there, fsck would have
used them.  If you have a valid locatedb database, you might be able
to use that to help reconstruct the filenames, and of course as a
responsible sysadmin you have been doing regular backups (RIGHT? :-),
so you could use that information as well.

Regards and good luck,

						- Ted