I recently learned a few lessons in dealing with a corrupted filesystem. This happened to me recently on a backup disk with two ext4 partitions. It was a laptop drive in a USB enclosure. I plugged the drive into a USB port that apparently didn't have enough power. I kept getting a disk read error trying to access it so I tried to remove it safely but could not. Both partitions were automounted by Nautilus and I was unable to un-mount them - I simply had to yank the USB cord. When I plugged it into another computer, both partitions refused to mount - bad superblock or something to that effect.
(Side note: I know about USB cables with two headers to get 2X the power; I should have plugged into the back USB port of this particular computer in the first place, to avoid this, instead of the weakly-powered front port. Another story.)
This was not a disaster for me as everything was backed up anyway - this WAS the backup disk. I could have just wiped the disk and re-copied everything. But I decided to use it as a learning exercise.
First I simply ran e2fsck on each partition. I had to do so manually, automatic mode refused to run. (I finally just issued the -y switch to avoid answering thousands of questions.) The biggest partition took about 20 minutes. At the end I could mount that partition again, but everything was gone from the top-level filesystem, moved into Lost+Found. Turns out all the files were intact, even the subdirectory structure of each subdirectory was intact. I was able to recreate the top-level structure manually from memory in about ten minutes and restore most of the files to the way they were.
So, had this been a real recovery, everything would have been fine - just a bit of a pain with a bunch of manual work but no files lost.
Was there a better way to go about this than running e2fsck at this point? It seems that the journal of each filesystem had simply gotten corrupted. I'm very unfamiliar with the journaling of ext3 and ext4. Is there some way to back up the journals to make a recovery a lot easier? Can I assume if a backup of the journal had existed that e2fsck would have tried to use it automatically?
(Another lesson re-enforced: even just READING from a filesystem you have mounted could result in corruption in these weird cases. I was not WRITING any files! It's important to be very careful when removing these external drives - best to eject them or "Safely Remove" them when you can!)
Bookmarks