recover JFS partition from rogue mkfs

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
dhdurgee
Posts: 5
Joined: 04 Apr 2021, 23:35

recover JFS partition from rogue mkfs

#1 Post by dhdurgee »

A few days ago I installed linux mint 20.1 to my laptop, as my current 18.3 release is going EOL this month. For a reason I have yet to determine the installer did a mkfs on my main data partition, which is formatted in JFS. I have no backup of this partition and as such will need to recover it in some manner.

The rogue mkfs replaced both of the superblocks, so the partition appears empty. I have not written anything to it since the event, so the files should be intact but inaccessible.

I am aware of one tool that I am told can recover the file content, but not the filesystem struction. It would require me to inspect each file and identify it by content. I would hope to avoid the need to take this approach as there are 60-70G of data on the partition.

Can one of your tools do more for me? I would hope there would be a way to search the partition for the files and directory structure and rebuild the superblocks from that data. I would plan to copy the partition to another drive and work on the copy to allow multiple attempts in case the first approach fails.

Any assistance appreciated.

Dave

recuperation
Posts: 2718
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: recover JFS partition from rogue mkfs

#2 Post by recuperation »

dhdurgee wrote: 05 Apr 2021, 00:02 A few days ago I installed linux mint 20.1 to my laptop, as my current 18.3 release is going EOL this month. For a reason I have yet to determine the installer did a mkfs on my main data partition, which is formatted in JFS. I have no backup of this partition and as such will need to recover it in some manner.

The rogue mkfs replaced both of the superblocks, so the partition appears empty. I have not written anything to it since the event, so the files should be intact but inaccessible.

I am aware of one tool that I am told can recover the file content, but not the filesystem struction. It would require me to inspect each file and identify it by content. I would hope to avoid the need to take this approach as there are 60-70G of data on the partition.

Can one of your tools do more for me?
No. Testdisk supports finding JFS partitions but not recovering dammaged ones. You would need to run Photorec which will assumably do the same as your mysterious recovery tool.

dhdurgee
Posts: 5
Joined: 04 Apr 2021, 23:35

Re: recover JFS partition from rogue mkfs

#3 Post by dhdurgee »

OK, I will keep that in mind. I may have another tool for this from a JFS specialty group. At present it is AIX specific, but they believe it can be released for linux as well.

Reading your page on Photorec it appears that there are cases where it can recover the directory structure. Is JFS one of the cases where this is possible? If so I will try your tool next if the JFS specific one does not work out.

Thank you for a timely response.

Dave

recuperation
Posts: 2718
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: recover JFS partition from rogue mkfs

#4 Post by recuperation »

dhdurgee wrote: 05 Apr 2021, 18:51 Reading your page on Photorec it appears that there are cases where it can recover the directory structure.
Where did you find this statement exactly?

Is JFS one of the cases where this is possible?
No. Photorec does not recover directory structures at all. It is an Armageddon tool. It's based on fingerprinting and relies on no or only low fragmentation.

dhdurgee
Posts: 5
Joined: 04 Apr 2021, 23:35

Re: recover JFS partition from rogue mkfs

#5 Post by dhdurgee »

recuperation wrote: 06 Apr 2021, 14:36
dhdurgee wrote: 05 Apr 2021, 18:51 Reading your page on Photorec it appears that there are cases where it can recover the directory structure.
Where did you find this statement exactly?

I guess I was reading too much into "for example, in an ext3/ext4 file system, the names of deleted files are still present, but the location of the first data block is removed." which suggested to me there might be a back-pointer from the data block to the meta-information. I am sorry to hear this is not the case.
Is JFS one of the cases where this is possible?
No. Photorec does not recover directory structures at all. It is an Armageddon tool. It's based on fingerprinting and relies on no or only low fragmentation.
That would be simiar to the other tools I am looking at in case the JFS specific approach does not work out.

Thank you for clarifying my error.

Dave

dhdurgee
Posts: 5
Joined: 04 Apr 2021, 23:35

Re: recover JFS partition from rogue mkfs

#6 Post by dhdurgee »

I thought I ought to follow-up where I am today with this.

I assisted the developer with converting his Aix tool to work in linux. The tool does indeed locate the almost complete file names and metadata as well as the contents. At its current state there are issues with older deleted files and directories yielding extra spurious results. This will likely be improved further in later versions. Unfortunately the use of the recovery tool itself as opposed to the free scanner is out of my ball park entirely in cost.

So it appears I will be needing to use another approach for recovery, possibly taking advantage of the output of the free tool to match recovered files based upon timestamp and size. The tool I am using as an alternative to Photorec shows over 48k file inodes for which the data can be recovered, albeit without names.

Is the classifier portion of Photorec available as a separate tool? Is it any better than the linux file command for recognizing a file type?

At this point I anticipate recovering the files into a directory and then linking them to other directories by file type. Once that is done I can work with the list results to match names to timestamp and size. Obviously this will be a long process, possibly some of which can be automated. I will likely need to triage this in some fashion.

Dave

recuperation
Posts: 2718
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: recover JFS partition from rogue mkfs

#7 Post by recuperation »

dhdurgee wrote: 21 Apr 2021, 20:28 Is the classifier portion of Photorec available as a separate tool?
https://www.cgsecurity.org/testdisk.pdf
Is it any better than the linux file command for recognizing a file type?
I don't know another linux file command.
But why should Christophe Grenier program a tool that already exists? There is only one reason for this...

dhdurgee
Posts: 5
Joined: 04 Apr 2021, 23:35

Re: recover JFS partition from rogue mkfs

#8 Post by dhdurgee »

Thank you for a speedy response. I had not reviewed the documentation for testdisk once I realized it could not handle the job itself. Looking there it appears that the fidentify utility is exactly what I will need once I have the content recovered.

Once again thank you for your timely assistance.

Dave

Locked