Advanced data recovery
(Initial page creation) |
m (→Tools to examine your hard drive) |
||
| Line 3: | Line 3: | ||
== Tools to examine your hard drive == | == Tools to examine your hard drive == | ||
| − | == ext fs header layouts | + | === hexdump === |
| + | |||
| + | === od === | ||
| + | |||
| + | == ext fs header layouts == | ||
An ext4 superblock typically starts 1K into the partition. Within the superblock, it contains the string 0xef53 at an offset of 0x38. | An ext4 superblock typically starts 1K into the partition. Within the superblock, it contains the string 0xef53 at an offset of 0x38. | ||
Revision as of 20:09, 22 June 2017
This page is all about the on-disk data structures, and what to look for to help you find where on disk your data is, and hopefully how to recreate the higher level structures to point linux at your data. It's very hard at this point to tell you what to do, so you will have to use this information as best you can.
Contents |
Tools to examine your hard drive
hexdump
od
ext fs header layouts
An ext4 superblock typically starts 1K into the partition. Within the superblock, it contains the string 0xef53 at an offset of 0x38.
od -x /dev/sdac2 | awk '$6 == "ef53"'
The output from od lists each 16-byte block in hex preceded by its location in octal, the awk only displays lines of interest. Subtract 0002060 from the first number of the first line (remember they're both octal!!!), and this should be the start of the partition.
If you're trying to recover a mirror, you can now point your partition table at this partition and hopefully everything will work.
