Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I had a mountable fs (pretty sure it was ext3), fsck.ext4 was run with -y and ended in a segmentation fault. Now it is unmountable (dmesg says it's corrupt) and identifies as a ext4 fs via the "blkid" command. The fs happens to sit on a raid 0 array mad up of 3 partitions.

As I am not 100% positive that is was originally ext3 I don't want to try running fsck.ext3. I also have no idea if that would work even if it was the case.

I would hope that fsck is intelligent enough to check the fs type and at least provide a warning.

Any suggestions on how to recover from this would be greatly appreciated.

share|improve this question
4  
Just cut your losses and restore from backup. –  EEAA Jan 5 at 17:59
2  
Depending on your OS the fsck.ext* programs are all hard/soft links to the same binary so yes it aught to be smart enough to figure out the fs type, you'd have to read the source to confirm that though. –  Iain Jan 5 at 18:10
1  
If there are no backups, then this was not a production server, correct? –  MDMarra Jan 5 at 18:16
1  
Inheriting a system is not an excuse not to improve it, that's rather unprofessional behaviour. –  Dennis Kaarsemaker Jan 5 at 19:06
1  
The snarky criticisms here do not help in answering the question about fsck. The comment area should be used to "ask for more information or suggest improvements", not for wandering into meta-topics about the company's bad practices. –  Stefan Lasiewski Jan 6 at 18:15

3 Answers 3

$ ls -la /sbin/fsck.ext?
lrwxrwxrwx 1 root root 6 jun 24  2013 /sbin/fsck.ext2 -> e2fsck
lrwxrwxrwx 1 root root 6 jun 24  2013 /sbin/fsck.ext3 -> e2fsck
lrwxrwxrwx 1 root root 6 jun 24  2013 /sbin/fsck.ext4 -> e2fsck

So the fsck you ran is the correct one. If your filesystem is now so corrupt it won't mount you have two options:

  • Restore from backup
  • Pay a lot of money to a data recovery company.
share|improve this answer
    
Thank you for the reply. It is still corrupt as fsck (version 2.19) segfaults. I am currently trying fsck (version 2.24) as some google results suggested segfaults weren't uncommon in older versions. –  The_Pacifist Jan 5 at 18:35
    
@The_Pacifist What OS distribution and version is this? –  ewwhite Jan 5 at 18:41
    
The fsck.ext4 was run on a liveboot archlinux with version 2.19 of fschk, it was an older version of archlinux 3.6ish kernel. The newest run with fsck 2.24 is being run on the most recent archlinux liveboot. fsck.ext? has independent binaries. –  The_Pacifist Jan 5 at 18:42
    
Arch Linux, no backup, RAID 0. Are you sure this isn't a home system? It sounds like the opposite of everything you want in a professional environment. –  MDMarra Jan 5 at 18:51
    
Archlinux liveboot, ubuntu 10.04 native. –  The_Pacifist Jan 5 at 18:51

This is probably software RAID, but assuming you can see the block device, my recommendation for data recovery on ext2/3/4, XFS and other Linux filesystem is UFS Explorer. It's commercial software, but relatively inexpensive.

Seeing as blkid returns the right filesystem type, running a UFS Explorer scan against the device (and redirected to another disk) may be a clean approach to seeing what's recoverable or not.

share|improve this answer

Update: So those curious the last fsck (version 2.24) was able to complete. All of the resulting data was in (lost+found). I am currently backing up this directory before extracting anything. At first glance though, the majority of the data does seem to be there. So it's just a matter of traversing inodes instead of directory trees.

Thank you all for your help.

share|improve this answer
    
on redhat 6 the fsck.ext? aren't link " ls -la /sbin/fsck.ext? -rwxr-xr-x. 5 root root 190344 Jun 25 2013 /sbin/fsck.ext2 -rwxr-xr-x. 5 root root 190344 Jun 25 2013 /sbin/fsck.ext3 -rwxr-xr-x. 5 root root 190344 Jun 25 2013 /sbin/fsck.ext4 " –  c4f4t0r Jan 6 at 17:54
1  
I hope you will be able to recover at least some of the data. When you are done with this crisis, schedule some time with your manager or the stakeholders and propose a plan to fix this system that you inherited. Make sure you are able to schedule time and resources to get the system to a point where it can be properly backed up and restored. While this may not be easy, it is the management's responsibility to see that you have the time and resources required to do the job properly. –  Stefan Lasiewski Jan 6 at 18:06
    
@c4f4t0r: They are hard links. The 5 after the r-x is the link count. The binaries are all the same size, they are the same binary. –  Iain Jan 7 at 8:57
    
@Iain yes that true :) –  c4f4t0r Jan 7 at 11:09
    
For the record I don't have a manager. I am a graduate student trying to graduate and play sysadmin. I know it's not the best scenario and there were bound to be mistakes/bad designs both inherited and designed. Thank you all for the help. –  The_Pacifist Jan 7 at 15:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.