On Sun, Oct 04, 2009 at 07:58:06PM +0200, frantisek holop wrote:
> hmm, on Fri, Oct 02, 2009 at 10:49:56PM +0200, Otto Moerbeek said that
> > > here's the thing: even though every single diagnostic message
> > > fsck may produce is documented in /usr/share/doc/smm/03.fsck_ffs
> > > i dont see how these questions help at all. what i mean is,
> > > there is nothing to compare the diagnostic data to anyway, so
> > > what is the answer going to be based on? so far i have always
> > > only took the leap of faith and pressed yes or always.. what
> > > else is there to do?
> >
> > make a dump of the partition before going to execute potentially data
> > destroying actions?
>
> yes, this is sound advice of course. but what are you going
> to do with the dump if say, fsck is not able to revive the fs?
> "dump" it back, run fsck again and answer "no" at a couple of
> fsck prompts? how is it going to change anything in the end?
Well, if fsck can't revive your partition, you can always try different
tools. Something like fsdb may be able to recover part or all of your
filesystem even in cases where fsck loses the plot. There is also the
Sleuth kit.
And if all else fails, you can always write your own software/grep
through the raw disk/etc. fsck is great at what it does, but it's not
the only game in town.
Needless to say, restoring from backup is easier than reconstructing a
filesystem from a hex dump of the disk. But sometimes you don't have
backups...
Joachim
