Linux: Bad Superblock Recovery

Bad superblock recovery

What do you do when you receive a “bad
superblock” error on a USB or other Flash drive?
Well, firstly you kick yourself for not backing up
important data on said drive for the past nine
days; you’re old enough to know better than that.
Secondly, you kick yourself for using that piece of
rubbish called the FAT32 filesystem which was
default for Windows 95, but is what every USB
drive ships with because it’s the last file format
released by Microsoft that actually communicates
with other operating systems, despite the fact that
it’s as buggy as hell and is prone to disaster.
Once you’ve done kicking yourself you look the
message. You could even try mounting the disk
e.g..,
mount /dev/sdb1 /mnt: Input/output error
mount: /dev/sda1: can’t read superblock
Now there’s a lot of cries for help on this issue as
a casual google search will indicate. However
there is a way to solve this.
First, make a copy of the disk image that isn’t
totally broken;
ddrescue -n /dev/old_disk /directory/backupfile
rescued.log
Then try to recover as much of the dicey areas as
possible;
ddrescue -r 1 /dev/old_disk /directory/backupfile
rescued.log
Now at least you’re not playing with the real
thing, for what it’s worth.
You could run a fsck on the disk, for what it’s
worth. But I found that foremost is the tool you
want to use. It recovers files using their headers,
footers, and data structures; which means it’s isn’t
brilliant at finding text files because they tend not
to have a header – these will often be buried in an
.exe file or similar.
The basic command to run is;
foremost -av backupfile
It won’t run quickly and you will end up with a lot
of files; including many backups of previous work,
jpegs and the like extracted from PDFs etc. You
will also want to run a grep over the directory to
find out where your text files are e.g.,
cd output
grep linux * -R
Perhaps not so surprisingly for something used in
law enforcement computer forensics and
developed by the United States Air Force Office of
Special Investigations, it’ll probably find almost
everything from your corrupted disk.

By: Lev Lafayette