Swapfile Follies

[bgsfh]

I was trying to set up a swapfile on my 4 gig Hitachi CF card on an SL 6000L running the Sharp rom V. 1.12.  Referencing this thread,

https://www.oesf.org/forums/index.php?showt...11799&hl=mkswap

I typed # mkswap /dev/hda1 as root.  This apparently formatted my whole 4 gig CF microdrive as a swapfile.  Is there any way to undo this and recover the previous ext2 formating and files on the CF card?  I don’t have access to a linux box to try to read the card.  (I am apparently dangerous enough with just my Zaurus.)

[lardman]

I typed # mkswap /dev/hda1 as root. This apparently formatted my whole 4 gig CF microdrive as a swapfile. Is there any way to undo this and recover the previous ext2 formating and files on the CF card?

Oops. It may be possible, perhaps, in the same way that undelete utilities work.

I don't know much about it though - I'd try some googling.


Si

[Meanie]

I was trying to set up a swapfile on my 4 gig Hitachi CF card on an SL 6000L running the Sharp rom V. 1.12.  Referencing this thread,

https://www.oesf.org/forums/index.php?showt...11799&hl=mkswap

I typed # mkswap /dev/hda1 as root.  This apparently formatted my whole 4 gig CF microdrive as a swapfile.  Is there any way to undo this and recover the previous ext2 formating and files on the CF card?  I don’t have access to a linux box to try to read the card.  (I am apparently dangerous enough with just my Zaurus.)
[div align=\"right\"][a href=\"index.php?act=findpost&pid=83798\"][{POST_SNAPBACK}][/a][/div]

you probably have to reformat your disk to ext2. linux does not have undelete or unformat like DOS. your files are lost unless you can find someone with data and disk forensics skills (and chances for that is very very slim unfortunately)

[lardman]

linux does not have undelete or unformat like DOS.

And not many people run dos now-a-days. I was able (after hours of frantic searching) to recover all of my important files from a 4GB drive which had suffered damage to the FAT (both of them in fact it would seem).

I imagine there must be tools for Linux which will search through a disk and look for files.

Some starting points:

http://www.tldp.org/HOWTO/Ext2fs-Undeletion.html
http://recover.sourceforge.net/linux/recover/
(http://recover.sourceforge.net/linux/)
(http://recover.sourceforge.net/unix/)


Si

[JohnX]

It *is* possible to undelete files from an ext2 partition.  I have done so in the past. It does however require that you haven't actually *written* over the space that those files were in.  If you've already used that swap space a couple times they're probably all *permanently* gone.

Here's my suggestion:
1) If you don't *really need* the files, I would chalk it up to experience and move on.
2) If you have the time and inclination to learn more about the ext2 filesystem than you ever wanted to know, you may be able to restore the files yourself.
3) If those files are absolutely irreplaceable you could get in touch with someone who has experience doing this type of thing, and bey/pay/bribe them to retrieve your files.

If you really need to get at those files post back here and I'll see what I can do to help.

-John

[bgsfh]

Thank you all for the responses.  I don't think the files have been overwritten.  I turned all swapfiles off (using the swapoff -a command) shortly after I realized what had happened.  I think this is recoverable because the cf card icon appears on the Qtopia toolbar, and the card is recognized properly under the Device tab in the Storage Info utility.  The card is not recognized as a storage device under the Storage tab of the Storage Info utility or the stock File Manager program, or in the Qtopia Files tab.  I didn't think recovering the ext2 file system at the time I made my first posting.  I will research that and report on my results in the next few days.

[lardman]

I note from the undelete HowTo which I linked that the fs needs to be unmounted anyway before you try anything, however as you've made it a swap partition the partition type (at least) will have been changed - this shouldn't be a major issue, however my understanding is that the swap partitions have some housekeeping info written to them - this may well have overwritten some of the important nodes in the ext2 fs.

If it hasn't, or the redundency is sufficient, then you may just be able to get on with it, otherwise you may need to look at how to repair an ext2 filesystem first.

Just a couple of thoughts,


Si

[JohnX]

Well, that is good news. The first step is to make a copy of the raw partition! I cannot overemphasize how important this is.  

Code: [Select]

dd if=/dev/hda1 of=/path/to/someplace/with/enough/space/cf-card.imgIn one of the HOWTO's about undeleting files it also says a simple cp will work:

Code: [Select]

cp /dev/hda1 /path/with/space/file.imgIt doesn't really matter what you name it.

I've undeleted files from a couple different filesystems.  The first time it was an ext2 filesystem.  This was on a late night about 5 or 6 years ago, so my memory of it is pretty sketchy by now.  I'm fairly sure that for the most part I followed the directions at http://www.tldp.org/HOWTO/Ext2fs-Undeletion.html.  To find the files I was interested in I used grep with the -b option.  A good hex editor (like hexedit) should work just as well.  I searched for the "file magic" of the files I was interested in.  For example JPEG images have the letters EXIF near the beginning of the file.  Once I found a file I was interested in I did some math in relating byte offsets to inode numbers.  After that I followed the instructions of the HOWTO I mentioned above.  I can't remember if I managed to develop a bash script to somewhat automate it.  I do remember that it took several hours to get a few files back.  If you're lucky, there's still enough of the ext2 fs left for debugfs to help you.  If not, read on...

The other time I undeleted files was from a corrupted FAT fs.  You may be wondering why I'm telling you about this, given the differences between FAT and ext2.  This situation might actually bear more of a resemblence to your current situation, since in both cases the actual filesystem might be gone and you're dealing with raw bits on a block device.  This time I used a hexeditor on the filesystem directly to search for the file magic.  I knew I was looking for JPEG files so I used EXIF as my search string.  If you're looking for text files you'll have to use some kind of string that you know to be in that text file as your search string.  After I found the offset that the file started at I crossed my fingers and hoped that it was all in one nice contiguous chunk.  Since the filesystem was on compactflash card that had been in a digital camera the files were all written one at a time in such a way that almost all of them were perfectly contiguous.  After I found out where each file started and ended, I used dd to copy out that chunk to a different filesystem, and tada, there was a picture.  In the end I found out that most JPEG interpreters are quite tolerant of serious problems with the files they are told to show so I just figured out a maximum size that the picture could be, and set a bash script loose on the whole fs and had it search for EXIF, skip a set number of bytes and copy the whole thing out.  Most images ended up with "garbage" at the bottom but that wasn't really a big issue, since some quick cropping could get rid of that.  I'm pretty sure I can dig up the script if you end up taking this method.  It might serve as a good starting point, but I'm sure it won't help in it's current state. And the code for it is rather ugly since I'm not much of a programmer.

Good luck with this.

[DrWowe]

The first step is to make a copy of the raw partition! I cannot overemphasize how important this is.

Yes, yes, this is a crucial thing to do.  Once you have made a copy of the partition, you should also make another a copy of the copy.  Now, the copy can be used for recovery activities, and in the meantime, you can reformat your Zaurus drive and make it useful again (although without your old data)

Another think to add is that backing up a 4 gig CF drive all in one shot may not be that easy, but you can also do it smaller chunks, for example, if you have an SD card.  If you had a 1 gig SD card and a card reader, you could do the backup in 8 chunks of 512 megs each and reassamble the chunks on your desktop.

[Stubear]

AFAIK mkswap doesn't delete or overwrite any data, if you never did swapon /dev/hda1 then your data is most likely still intact.

To get an ext2fs partition back after mkswap-ing it, do a dd as recomended above (to make a backup) the try

Code: [Select]

e2fsck -b 8193 (actually e2fsck <image file name> might work depending on your version of e2fsck)

It should complain about block bitmap differences and ask you if you want to fix - say yes

try mounting the image file on a linux machine (you can use a live cd like knoppix to do this if you don't have access to a linux machine, or if you have a space card with 1GB or more space, copy it to that and mount it on your Z.

Code: [Select]

mount -o loop -t ext2 /mnt/netIf mount doesn't complain then have a look in /mnt/net to see if your files are still there.

If that works then you could try it in the card (replace <image file name> with /dev/hda1)

I've done this before on a pc, and tested it with an image file I just created and I got the data back in both cases, YMMV

Good luck

Stu

[bgsfh]

This is an update to this topic.  

I finally got off my lazy --- and looked into fixing this.  

I tried a straight cp of /dev/hda1 to my Archos 340 by USB connection.  After more than 1 and 1/2 hours(!) I got an error message that the 2 gig filesize had been exceeded.  Doh!

Without spending the time to figure how to use cp to copy the rest of the microdrive, I tried to use fsck.  

Fsck would give me an error 2 with whatever I tried.  

E2fsck would say that it couldn't find an ext2 filesystem, even when I used the alternate superblock -b 8193

I tried to mount and umount /dev/hda1 and got invalid argument errors.  

This was all tried with the cf icon showing on the menu bar.  
I ejected the card using the menu bar, left the card in the slot and got the same invalid argument errors with mount and umount.  I got slightly different errors with fsck and e2fsck.  

So I suspended the Zaurus, physically removed the microdrive from the cf slot, turned the Zaurus back on, and inserted the microdrive and waited for the icon to show up on the menu bar.  

Then I tried to mount /dev/hda1 with the -f switch.  Mount didn't give me any error message, but I couldn't cd to /dev/hda1 or /usr/mnt.rom/cf.  

But after the forced mount, e2fsck started.  It complained about an incompletely unmounted drive but it ran.  

After I said yes to a lot of requests to repair a lot of stuff I didn't understand, it admonished me that the file system had been changed, and kicked me back to a command prompt.  

But I still couldn’t mount /dev/hda1 from the command line.  

So I ejected the card from the menu bar, suspended the Zaurus, physically pulled the microdrive from the cf slot, turned the Zaurus back on, and inserted the microdrive.  

And amazingly . . . .  all of my files scrolled up on the file manager.  

From a cursory inspection, they appear to be undamaged.  

I would like to take this opportunity to thank the people who ported e2fsck to the Zaurus and the people who responded to this thread.  And I would like to admonish everyone not to fool around with the mkswap command late at night.