linux-ext4 - Re: Fwd: Fwd: strange e2fsck magic number behaviour

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Fri, 13 Sep 2013 15:46:15 -0400
From:	Theodore Ts'o <tytso@....edu>
To:	Alexander Harrowell <a.harrowell@...il.com>
Cc:	Eric Sandeen <sandeen@...hat.com>, linux-ext4@...r.kernel.org
Subject: Re: Fwd: Fwd: strange e2fsck magic number behaviour

On Fri, Sep 13, 2013 at 01:33:12PM +0000, Alexander Harrowell wrote:
> Hmm, coming back to this, block 16777215 with identical content is
> recurring at intervals of 8 inodes.

So you might want to check and see if there are overlapping metadata
blocks --- that is, a bitmap allocation block that is also part of the
inode table block, or multiple block groups that point at the same
place for their inode table block.

The other thing is before you do more experimentation, I hope you have
made an image backup of your disk.  The more you play games by running
clri and then re-running e2fsck, the more likely that you might
accidentally do damage that might cause less data to be recovered.

In general, especially when the file system is this small such that
it's relatively easy to do an image level backup, the moment that you
think something might have gone off the rails, the wisest thing to do
is to make an image-level backup of the partition before you try to
repair things.

The other thing that has to be asked here is how much do you care
about this 64GB worth of data?  How much is OS data that can be easily
reproduced via an install, and how much are things like your home
directory?  And how recent was your last backup?  It may be that it's
not worth doing a whole lot more work trying to figure out what was
going on.

The other thing is that if this file system is this small, would you
be willing to use e2image to send me a copy of the metadata blocks, so
I can take a look at it myself.  No guarantees that I will find
anything useful, but I'll probably get more information that way.

Regards,

							- Ted
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html