[ale] {Really} recovering an ext3 drive

[James P. Kinney III]

On Mon, 2003-01-20 at 12:43, Danny Cox wrote:

> 
> 	Here's what I have: an ext3 fs as a "magic number" of 0xef53 at offset
> 0x438.  So, here's another stab at the problem:
> 
> 	Copy the 4 gigs or so that have the actual data info to a file you can
> play with.  This also protects the original.  Write a small program that
> reads 1024 byte blocks at a time, and search for that magic number at
> offset 56 (decimal) in that block.  When found, you'll need that block
> less one.  Copy those blocks into another file.  You should be able to
> mount that file via the loop interface.  Perhaps then you'll see some
> files, perhaps not.  At any rate, you can play with the copies as much
> as you wish, while still protecting the original.

I'm not up on the physical layout of the data on the drive. How does the
file system interact with the physical (or logical) structure of the
hard drive. 

For instance, I have a hard drive that reports x sectors of y size and z
cylinders. I have an inode size of w. It seems to me from your example
that the offset is from the beginning of the inode marker? So the read
size needs to be the block size?

I really need to learn more of this.

> 
> 	Perl may suffice for this, but I'd use C.  But that's just me ;-).
> 
> 	Hope this helps!
-- 
James P. Kinney III   \Changing the mobile computing world/
President and CEO      \          one Linux user         /
Local Net Solutions,LLC \           at a time.          /
770-493-8244             \.___________________________./

GPG ID: 829C6CA7 James P. Kinney III (M.S. Physics) <jkinney at localnetsolutions.com>
Fingerprint = 3C9E 6366 54FC A3FE BA4D 0659 6190 ADC3 829C 6CA7 



 This is a digitally signed message part