Ubuntu – File recovery after reformattig ext3/4 partition — extract old journal/superblock

data-recoveryext4

I seem to have reformatted my /home partition (previously ext4) as ext3 during an Ubuntu installation. It took me a couple of mounts to figure that out. Which, of course, is a bad thing. I've tried some of the usual data recovery tools – photorec gives me ~60000 files, but of course completely unsorted.

I've stumbled across ext4magic, which is able to restore accidentally deleted files while preserving the directory structure, metadata etc. However, as the doc states:

Was accidentally created a new file system on the old, and thus the file system meta data are completely overwritten, this option can not help because, then only a empty file system will be found.

I'm now wondering if there is any way to extract the old metadata from the image so as to feed them to ext4magic separately. This, I guess, would require that the journal/superblocks of the new file system have been written to different blocks than they were before. Are those blocks the same on every format (which would defeat my endeavor), or are they somehow randomly assigned? Any chance that the change from ext4 to ext3 comes in handy here?

Of course, other solutions are welcome as well.

Best Answer

Save the journal data of a ext3/4 file system to a file:

debugfs -R "dump <8> /PATH/journal.copy" /dev/DEVICE 

(see Wiki ext4magic)

This copy can be used with ext4magic or extundelte. But these are not all the metadata. These are just some old inode. Also needed to restore the inode table and the directory data blocks. Without this it will not work, especially with ext3. (ext4 and ext4magic, possibly many files can restored but without original name and path.

This metadata could be stored with e2image, but at moment extundelete and ext4magic can not use such a additionally dump file.

Related Question