Ext3 Suicide

[samurailink3]

Heya! I'm having a bit of a problem with an external hard drive that was formatted as Ext3 and was fishing for suggestions.. I mounted the drive today only to have it display nothing. Not one single file, BUT the drive does report the correct amount of free space. I've tried 'fsck.ext3 -f' on the drive, but to no avail. And helpful suggestions or a way to completely reindex the inodes of the filesystem? I'm pretty sure the data is completely in tact, as the drive reports the correct free space, but I'm pretty sure the file tree is corrupted.

How would I go about getting this back.

Insert sob story: Its a 1T media drive, I have 22G free

Thank you, helpful Linux Gods!

Here's the output from testdisk:

     Partition                  Start        End    Size in sectors

  ext3                           0 1953524655 1953524656
superblock 0, blocksize=4096
superblock 32768, blocksize=4096
superblock 98304, blocksize=4096
superblock 163840, blocksize=4096
superblock 229376, blocksize=4096
superblock 294912, blocksize=4096
superblock 819200, blocksize=4096
superblock 884736, blocksize=4096
superblock 1605632, blocksize=4096
superblock 2654208, blocksize=4096

Not near the drive right now, but if you could throw out suggestions for me, I'd greatly appreciate it.

[Rubberman]

Before you run fsck on the file system, make sure it is unmounted. Then try "fsck -v -f drive+partition" where drive+partition would be something like /dev/sdg1. The -v option will put fsck into verbose mode and might give you more useful information. BTW, did you unplug it without unmounting it first the last time you used it successfully? Anyway, the exit code will tell you something about the results of the fsck operation. From the man pages for e2fsck (fsck.ext3 is alias for this):

       The exit code returned by e2fsck is the sum of the following conditions:
            0    - No errors
            1    - File system errors corrected
            2    - File system errors corrected, system should
                   be rebooted
            4    - File system errors left uncorrected
            8    - Operational error
            16   - Usage or syntax error
            32   - E2fsck canceled by user request
            128  - Shared library error

[samurailink3]

It was always unmounted before unplugged. The device is TrueCrypt encrypted, but I can map the unencrypted partition without mounting it. Will report back later with findings (Currently away from drive).

[Rubberman]

If the entire drive and/or partition are encrypted, then you need to make sure that you are running fsck agains the decrypted version. I'm not sure how TrueCrypt works - does it present a decrypted file system entry point for the drive/partition?

[samurailink3]

With my configuration, the entire drive (including partition table is encrypted), but I can decrypt the drive to show file system entry points without having to mount the filesystem. The "Decrypted" drive is thrown onto /dev/mapper/truecrypt1. I'm currently running fsck against that.

[samurailink3]

Here's the output I've got:

sudo fsck -v -f /dev/mapper/truecrypt1
fsck 1.41.4 (27-Jan-2009)
e2fsck 1.41.4 (27-Jan-2009)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information

  796433 inodes used (1.30%)
    6747 non-contiguous files (0.8%)
     623 non-contiguous directories (0.1%)
         # of inodes with ind/dind/tind blocks: 81923/11735/20
225472974 blocks used (92.33%)
       0 bad blocks
      41 large files

  340737 regular files
  427068 directories
       0 character device files
       0 block device files
       0 fifos
 2580077 links
   28615 symbolic links (28609 fast symbolic links)
       4 sockets
--------
 3376501 files

[Rubberman]

That seems like a huge number of links - 2.5M hard links? 340K files? 425K directories?

[Lakshmipathi]

After running fsck did it said something like "you can your reboot or you file system is clean" .... I forgot the exact message though.

[Rubberman]

After running fsck did it said something like "you can your reboot or you file system is clean" .... I forgot the exact message though.

Is that clean as in "there are no problems here", or clean as in "there is nothing here"?

[samurailink3]

Unfortunately, that's all the output fsck gave. The huge number of hardlinks can be explained though. I also use this drive for running rsync/rsnapshot to backup my main drive, and those use hardlinks for duplicating repeated data across various folders.

Is there any other way that fsck can rebuild the index?