0

I faced some non-standard behavior in ext4 partition on my external drive.
After i disconnect my disk from laptop and reconnect again i witnesssed something odd: i somehow lost some of my files... Or i should say that connections of inodes are lost...

What i already done:

  • e2fsck with -b option
  • ext4magic with specifying exact inode
  • testdisk
  • photorec

I know exact folder and inodes what i need to recover [20578332-20578358]

When i run ext4magic to analyse inode i get this output:

sudo ext4magic /dev/sdd7 -I 20578332    
Filesystem in use: /dev/sdd7


Dump internal Inode 20578332
Status : Inode is Unallocated

Inode: 20578332   Type: bad type    Mode:  0000   Flags: 0x0 
Generation: 0    Version: 0x00000000
User:     0   Group:     0   Size: 0
File ACL: 0    Directory ACL: 0
Links: 0   Blockcount: 0
Fragment:  Address: 0    Number: 0    Size: 0
ctime:          0 -- Thu Jan  1 03:00:00 1970
atime:          0 -- Thu Jan  1 03:00:00 1970
mtime:          0 -- Thu Jan  1 03:00:00 1970
Size of extra inode fields: 0
ext4magic : EXIT_SUCCESS

which shows that inode have bad type thing...
Is there anyway to restore it?

I can try to ddrescue it, but recovering whole partition of 1TB will go for a couple of days... i need to recover only those inodes

Edit #1: When running a Histogram info it shows that items where created but not deleted:

sudo ext4magic /dev/sdd7 -a $(date -d "-2month" +%s) -f Camera01 -j /opt/sdd7.journal -H
Filesystem in use: /dev/sdd7

Using external Journal at File /opt/sdd7.journal 
Activ Time after  : Tue Jun 13 12:31:08 2023
Activ Time before : Sun Aug 13 12:31:08 2023
Inode found "Camera01"   20578305 
Inode 20578305 is allocated
|-----------c_time  Histogram-----------------  after  --------------------  Tue Jun 13 12:31:08 2023
1687175708 :       27 |**************************************************|   Mon Jun 19 14:55:08 2023
1687702748 :        0 |                                                  |   Sun Jun 25 17:19:08 2023
1688229788 :        0 |                                                  |   Sat Jul  1 19:43:08 2023
1688756828 :        0 |                                                  |   Fri Jul  7 22:07:08 2023
1689283868 :        0 |                                                  |   Fri Jul 14 00:31:08 2023
1689810908 :        0 |                                                  |   Thu Jul 20 02:55:08 2023
1690337948 :        0 |                                                  |   Wed Jul 26 05:19:08 2023
1690864988 :        0 |                                                  |   Tue Aug  1 07:43:08 2023
1691392028 :        0 |                                                  |   Mon Aug  7 10:07:08 2023
1691919068 :        0 |                                                  |   Sun Aug 13 12:31:08 2023


|-----------d_time  Histogram-----------------  after  --------------------  Tue Jun 13 12:31:08 2023
1687175708 :        0 |                                                  |   Mon Jun 19 14:55:08 2023
1687702748 :        0 |                                                  |   Sun Jun 25 17:19:08 2023
1688229788 :        0 |                                                  |   Sat Jul  1 19:43:08 2023
1688756828 :        0 |                                                  |   Fri Jul  7 22:07:08 2023
1689283868 :        0 |                                                  |   Fri Jul 14 00:31:08 2023
1689810908 :        0 |                                                  |   Thu Jul 20 02:55:08 2023
1690337948 :        0 |                                                  |   Wed Jul 26 05:19:08 2023
1690864988 :        0 |                                                  |   Tue Aug  1 07:43:08 2023
1691392028 :        0 |                                                  |   Mon Aug  7 10:07:08 2023
1691919068 :        0 |                                                  |   Sun Aug 13 12:31:08 2023


|-----------cr_time Histogram-----------------  after  --------------------  Tue Jun 13 12:31:08 2023
1687175708 :       27 |**************************************************|   Mon Jun 19 14:55:08 2023
1687702748 :        0 |                                                  |   Sun Jun 25 17:19:08 2023
1688229788 :        0 |                                                  |   Sat Jul  1 19:43:08 2023
1688756828 :        0 |                                                  |   Fri Jul  7 22:07:08 2023
1689283868 :        0 |                                                  |   Fri Jul 14 00:31:08 2023
1689810908 :        0 |                                                  |   Thu Jul 20 02:55:08 2023
1690337948 :        0 |                                                  |   Wed Jul 26 05:19:08 2023
1690864988 :        0 |                                                  |   Tue Aug  1 07:43:08 2023
1691392028 :        0 |                                                  |   Mon Aug  7 10:07:08 2023
1691919068 :        0 |                                                  |   Sun Aug 13 12:31:08 2023
ext4magic : EXIT_SUCCESS
Improve this question
3
  • 1
    Quick hits: (1) Stop guessing what to do and just trying the next tool on the original data. (2) Do not try to (auto)mount the disk. Any access after mount (also read only) can destroy relevant data. (3) Get a plan how to safely test your possibilities: (2a) Check for the reason of the failure. (2b) By the knowledge of (a) you can choose the right strategy to make a 1:1 copy (2c) Only test your rescues on the copy or (in case of hardware errors) on a copy of your copy.
    – dodrg
    Commented Aug 13, 2023 at 11:13
  • 1
    ddrescue is usefull if you have hardware errors. If this is not the case it won't be better than dd. — You do not write anything about hardware problems. You only write about problems related to the filesystem (a logical thing, not hardware). — If dd terminates its work before the job has finished, then it's time for ddrescue. Perhaps you want check the S.M.A.R.T. values for hints first (i.e. see smartmontools.org).
    – dodrg
    Commented Aug 13, 2023 at 11:26
  • 1
    Without an info update hardly anyone will answer.: (1) Did you check for hardware errors? Results? (2) What did you change on the disk in which order by which commands? // The current status is pretty unpredictable so its impossible to give qualified replies. (3) A disks does not loose "some files". There is a reason, so did you reflect what has gone wrong when you disconnected the drive? Describe the action.
    – dodrg
    Commented Aug 13, 2023 at 19:20

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .