[mdlug] Recovering damaged EXT2

[Aaron Kulkis]

Michael Rudas wrote:
> --- David McMillan wrote:
> 
>> Now, when I try to mount it, I get a "bad superblock"
>>  error.  If I try to run fsck or e2fsck, I get
>> "the superblock is corrupt" and a suggestion to run
>> e2fsck with the "e2fsck -b 8192 <device".  But if I
>> try that, I get a "device busy" error message, even
>> though the partition is not mounted and no
>> other process is accessing that drive.
> 
> It sounds like the drive is mechanically pranged.  If the platter spindle
> gets bent or pushed to one side, it can often read the partition table but
> hang up on the platter when it tries to track across the disc (usually
> noisy, though).  It's also possible that the platter has been gouged by the
> head--or one of the (multiple) heads has been dislodged and no longer reads
> that side of its platter.  The "Device busy" error may be the HD waiting for
> the data flow from the missing head.
>


And if that is the case (which I suspect it is), then
you'll have to hire a data forensics service.  Worst case
scenarios are that they have to remove the platters from
your current drive chassis and put them into another drive
chassis.

This is rather expensive (it requires a "clean
room" although the actual space could be a box on a table
with both air filters and an air evacuation system, and
of course, a set of air-proof gloves going into the box
to do the actual work).

If this doesn't work, then they can go to scanning electron
microscopes, and that can detect each and every magnetic
field on the platters -- but, that's REALLY expensive
($10k typical).

So, before you proceed, you have to ask yourself some
questions:

1: How valuable are the files on this disk drive
 (in terms of what the business uses them for)?

2: How much money (wages, etc.) and time will it
   cost to re-generate the data?

3: How much time is the business able to spend
    to regenerate the data?

4: In light of (1), (2) and (3) above, how much is the
   business prepared to pay to recover these files?


If the data on the disk is worth $1,000,000, then
spending up to $10k to recover the data is something
you should agree to without hesitation.

On the other hand, if the business value of the data
is only worth $100, then probably not.

These, of course, are extremes.  I'm sure that the
value of your data is somewhere in between.




Lesson:  There's no substitute for a traditional backup
system -- be it tape drives, or network attached storage
(so that the disks are sitting in a larger computer
chassis and not likely to get dropped on the floor).

Businesses that skimp on data backup are prone to
being put out of business by accidents such as these.