ext3 - recovering garbaged directory structure

LinuxSmiley · n00b Joined: 13 May 2004 Posts: 36

Hello everybody,

due to some odd hard disk failure and (I suppose) a mistake of e2fsck my server lost some of its directories:

NeddySeagoon · Posted: Thu Jun 22, 2006 3:51 pm Post subject:

LinuxSmiley,

Provided neither the data nor the partition are encrypted and you can find a seach string, ther is a chance.
Get hexedit, point it at the partition or better, your image of the partition, switch to string mode and search for a string.
I guess imap, means its your emal, so your email address may be a good seach string.
Every time you find something copy it to a file. That way you will create a .maildir format mailbox.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

LinuxSmiley · n00b Joined: 13 May 2004 Posts: 36

Thanks, that was my first idea, too, and it works with the scripts I lost ... but:

- there are about 25 different e-mail-accounts on the system not only mine
- the mails sum up to a total of about 10000 single mails ;-)

Isn't there a possibility to search for the contents of the directory directly on the filesystem? I definitively know that there are 26 directories named "a" to "z" and a file named ".keep" in /var/spool/imap. If I could find the adress of this directory index it should be possible to re-assign the missing inode entry in the /var/spool directory structure.

I'm really, really in need of these mails

/Edit: Has your signature anything to do with my case? :roll:

NeddySeagoon · Posted: Thu Jun 22, 2006 8:55 pm Post subject:

LinuxSmiley

You can try but they provide very short search strings.
I don't know how you would recover a whole dorectory because its contents could be fragmented all over the drive.
You would need to reconstruct the pointers to it and maybe update the free space bitmap.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

LinuxSmiley · n00b Joined: 13 May 2004 Posts: 36

Hi NeddySeagoon,

NeddySeagoon · Posted: Fri Jun 23, 2006 9:21 am Post subject:

LinuxSmiley,

You have the theory of the filesystem.

When e2fsck made your filesystem structure self consistant, it did so without regard to any data you had on the filesystem.
However, any data that did not belong in the fsck'ed fs is now in lost+found at the top level of the partition affected.
Such data is named by inode number if its name is not know. Its worth looking there.

The drawback with the filesystem theory is that with your imap directory inode being free, e2fsck will have freed all the inodes that belong to it too, or added them to lost+found. That makes recovery difficult.

Look at

LinuxSmiley · n00b Joined: 13 May 2004 Posts: 36

That folder was one of the first I checked but there were only two directories and a couple of files. The directories were identical and seemed to be /var/spool/imap/i/user/istroeter ... the files were mails from other accounts but not even near the total number of e-mails.

I wrote a little PHP script parsing through the image of the partition looking for "Received: " and then copying everything until the next null-byte into a new file - it found over 145000 files and almost all seem to be e-mails (although nearly every ever deleted spam mail got restored, too :-/). So if you don't know a tool which could accomplish my idea written in the previous post(s) then I'm fine with feeding all the recovered mails to my Cyrus IMAP server again.

Thanks for your time and effort!