Advanced Find ext2 ext3 Backup SuperBlock

From CGSecurity
Jump to: navigation, search

En.png english version De.png deutsche Version Es.png versión español Fr.png version française It.png versione italiana


If the ext2/ext3 primary superblock is damaged, the filesystem cannot be mounted.

If the normal superblock is corrupted, fsck will search for an alternative superblock but may fail to find any of them. The location of the backup superblocks are dependent on the filesystem's block size. This size is stored in the superblock, so it isn't known while searching for the backup superblock. To search for them, run TestDisk and in the Advanced menu, select the partition and choose Superblock.

The superblock contains all the information about the configuration of the filesystem. The primary copy of the superblock is stored at an offset of 1024 bytes from the start of the partition, and it is essential to mounting the filesystem. Since it is so important, backup copies of the superblock are stored in block groups throughout the filesystem. The first version of ext2 (revision 0) stores a copy at the start of every block group, along with backups of the group descriptor block(s). Because this can consume a considerable amount of space for large filesystems, later revisions can optionally reduce the number of backup copies by only putting backups in specific groups (this is the sparse superblock feature). The groups chosen are 0, 1 and powers of 3, 5 and 7.

Now using the value given by TestDisk, you can use fsck to repair your ext2/ext3 filesystem. I.E. if TestDisk has found a superblock at block number 24577 and a blocksize of 1024 bytes, run

/sbin/fsck.ext3 -b 24577 -B 1024 /dev/hda1

Back to Running the TestDisk Program