前几天遇到一个 Linux Ext3 文件系统超级块(Superblock)错误问题.
.... bad superblock on /dev/hda4
一个同事做的恢复, 结果把数据都抹掉了. 后来想想, 当时的直接 fsck 的恢复方法不对. 正确的方法应该是这样的:
1 获取错误的出错磁盘(或者设备)块的大小.
有很多种方法可以得到. 比如,
# tune2fs -l /dev/hda4
其实大多数情况下是 1 K.
2 对当前的出错磁盘备份.
恢复超级块(Superblock)的过程其实也是一个有风险的过程.能做备份就做好备份. 如果有其他空闲设备, 用 dd 命令把该设备上的内容备份起来.
3 一般来说, 超级块错基本上也就是主超级块错, 在 Ext2/Ext3 文件系统创建的时候, 会同时在屏幕上提示我们在已经在几个地方备份了超级块.那么怎么发现这些超级块在什么地方呢? 我们看看帮助信息:
-b superblock
Instead of using the normal superblock, use an alternative
superblock specified by superblock. This option is normally
used when the primary superblock has been corrupted. The loca-
tion of the backup superblock is dependent on the filesystem’s
blocksize. For filesystems with 1k blocksizes, a backup
superblock can be found at block 8193; for filesystems with 2k
blocksizes, at block 16384; and for 4k blocksizes, at block
32768.
Additional backup superblocks can be determined by using the
mke2fs program using the -n option to print out where the
superblocks were created. The -b option to mke2fs, which spec-
ifies blocksize of the filesystem must be specified in order for
the superblock locations that are printed out to be accurate.
If an alternative superblock is specified and the filesystem is
not opened read-only, e2fsck will make sure that the primary
superblock is updated appropriately upon completion of the
filesystem check.
4 开始恢复.如果文件系统块大小为1K, 则我们可以用如下命令恢复:
# /sbin/fsck.ext3 -b 8193 /dev/hda4
如果这个备用块(8193)也有问题,那么 可以尝试 24577(8192*3+1) ,或者是 40961 (8192*5+1).