0

I have a 4TB external USB drive that appears to be having some hardware issues. I am unable to mount it and I get some IO errors.

I am creating an image now of the ext4 (maybe ext3?) partition with testdisk, but I don't have 4TB of space to copy the entire partition. But I probably don't need to recover 4TB worth of data, there might only be 50gb. When I try running fsck on what testdisk has copied so far, i get errors:

# fsck.ext4 -y image2.dd 
e2fsck 1.43.4 (31-Jan-2017)
ext2fs_open2: Bad magic number in super-block
fsck.ext4: Superblock invalid, trying backup blocks...
Superblock has an invalid journal (inode 8).
Clear? yes

*** journal has been deleted ***

The filesystem size (according to the superblock) is 976712704 blocks
The physical size of the device is 9188066 blocks
Either the superblock or the partition table is likely to be corrupt!
Abort? yes


image2.dd: ***** FILE SYSTEM WAS MODIFIED *****
DAB
  • 181
  • I probably don't need to recover 4TB worth of data, there might only be 50gb -- You cannot be sure the data you're after is at the beginning, even if it's the only data in the filesytem. Compare this question and my answer there. – Kamil Maciorowski Jun 10 '19 at 06:55
  • good point - i was hoping maybe the disk structure was at the beginning - or maybe there's a way to copy a sparse image that ignores most of the disk, that i can still run fsck on? – DAB Jun 13 '19 at 13:04

1 Answers1

0

The journal is usually somewhere at the end, and if you haven't copied the journal, fsck will have a lot more trouble. As you can also see, it complains about mismatching sizes.

So while you certainly can run fsck on a partial image, the results will not be satisfying ...

I can't think of any good way to do this without copying the complete image.

There's debugfs if you want to meddle with the ext-filesystem directly, but you'll need a good understanding how the ext-filesystem works.

dirkt
  • 16,899