Some options missed when dealing with a disk image
Posted: 10 Jan 2016, 20:41
Hello,
I'm quite successfully dealing with the image of a corrupt ext3 partition (thanks!), but I have some questions:
When saving whole directories, is it possible to only copy the undeleted files/subdirectories? i.e., not those marked in red? Otherwise, I will have to either ignore these unwanted files, or I would have to find them on the regenerated directory structure, which would be very tedious (root partition with thousands of files in the directory tree...)
And can I get a complete listing of the files in the image as a text output, analogous to "ls -R --full-time > listing", enriched with additional markers (e.g., "not/partially/fully recovered", "deleted file")? Otherwise, it is hopeless to find out what I have to scrape from some backups or maybe reinstall...
Also, I was all missing symbolic links etc., these were just silently not created.
Maybe I'm just missing some existing options?
Thank you!
-Stefan
P.S.
If it is of interest, some background information:
Root partition defective (could no longer boot; saving to a partition image with "dd if=/dev/sda5 of=sda5.img bs=..." failed at some place. I tried "dd conv=noerror...", which worked. Repairing this image with fsck: results in lots of entries in lost+found and no hints at all what happened. So I tried testdisk, which is much more appropriate and shows that most can be recovered. I also tried ddrescue instead of dd, but this resulted in an image which could neither be mounted nor be inspected by testdisk. (Maybe it is because disk errors are spreading, so I will not touch the physical disk unless I know why I should.)
I also tried extundelete and ext4magic. These do not work on either partition image ("Error 2133571364 while reading journal") but I might not have tried everything possible.
-Stefan
I'm quite successfully dealing with the image of a corrupt ext3 partition (thanks!), but I have some questions:
When saving whole directories, is it possible to only copy the undeleted files/subdirectories? i.e., not those marked in red? Otherwise, I will have to either ignore these unwanted files, or I would have to find them on the regenerated directory structure, which would be very tedious (root partition with thousands of files in the directory tree...)
And can I get a complete listing of the files in the image as a text output, analogous to "ls -R --full-time > listing", enriched with additional markers (e.g., "not/partially/fully recovered", "deleted file")? Otherwise, it is hopeless to find out what I have to scrape from some backups or maybe reinstall...
Also, I was all missing symbolic links etc., these were just silently not created.
Maybe I'm just missing some existing options?
Thank you!
-Stefan
P.S.
If it is of interest, some background information:
Root partition defective (could no longer boot; saving to a partition image with "dd if=/dev/sda5 of=sda5.img bs=..." failed at some place. I tried "dd conv=noerror...", which worked. Repairing this image with fsck: results in lots of entries in lost+found and no hints at all what happened. So I tried testdisk, which is much more appropriate and shows that most can be recovered. I also tried ddrescue instead of dd, but this resulted in an image which could neither be mounted nor be inspected by testdisk. (Maybe it is because disk errors are spreading, so I will not touch the physical disk unless I know why I should.)
I also tried extundelete and ext4magic. These do not work on either partition image ("Error 2133571364 while reading journal") but I might not have tried everything possible.
-Stefan