[H-GEN] Ext3 partition unformat

[Ted Percival]

QuarkAV.com - Hilton Travis wrote:
> So, does anyone know of a way to successfully recover from an accidental
> reformatting of an Ext3 filesystem?

I don't know whether it will work, but some suggestions:
1. Back up your filesystem as it currently stands.
2. Destroy the superblock! According to debugfs(8) the superblock is
1024 bytes from the beginning of the filesystem. I don't know how big it
is but write some zeroes starting at that area using dd(1) and
/dev/zero. How many? I guess 512 bytes would be a reasonable start, or
you might be able to find out how big the superblock actually is.
3. Look for backup superblocks. mke2fs(8) says a little bit about backup
superblocks, the original ones were probably destroyed and overwritten
by your reformat, but don't blow them away with dd(1) until you've
checked using `debugfs -s <superblock>` whether they miraculously still
describe your old filesystem. I think backups are usually placed based
on the block size and (maybe) partition size, so unless your new
filesystem is different in that respect, the original backup superblocks
have probably been trashed.

Once you've destroyed info about the current, valid filesystem your
recovery tools might have a better chance of finding the old data. Of
course you're probably better off with a tool that scours the disk for
inodes and tries to rebuild the filesystem than something that merely
tries to "preen" your filesystem back into a working state.