Running Linux, 5th Edition - Matthias Kalle Dalheimer [479]
Repairing Filesystems
As discussed in "Checking and Repairing Filesystems" in Chapter 10, you can use fsck to recover from several kinds of filesystem corruption. Most of these filesystem problems are relatively minor and can be repaired by booting your system in the usual way and running fsck from the hard drive. However, it is usually better to check and repair your root filesystem while it is unmounted. In this case, it's easier to run fsck from an emergency floppy.
There are no differences between running fsck from floppy and from the hard drive; the syntax is exactly the same as described earlier in the chapter. However, remember that fsck is usually a frontend to tools such as fsck.ext3. On other systems, you'll need to use e2fsck (for Second Extended filesystems ).
It is possible to corrupt a filesystem so that it cannot be mounted. This is usually the result of damage to the filesystem's superblock, which stores information about the filesystem as a whole. If the superblock is corrupted, the system won't be able to access the filesystem at all, and any attempt to mount it will fail (probably with an error to the effect of "can't read superblock").
Because of the importance of the superblock, the filesystem keeps backup copies of it at intervals on the filesystem. Second Extended filesystems (and ext3, which is mostly the same) are divided into "block groups ," where each group has, by default, 8192 blocks. Therefore, there are backup copies of the superblock at block offsets 8193, 16385 (that's 8192 × 2 + 1), 24577, and so on. If you use the ext2 or ext3 filesystem, check that the filesystem has 8192-block groups with the following command:
dumpe2fs device | more
(Of course, this works only when the master superblock is intact.) This command will print a great deal of information about the filesystem, and you should see something like the following:
Blocks per group: 8192
If another offset is given, use it for computing offsets to the superblock copies, as mentioned earlier.
If you can't mount a filesystem because of superblock problems, chances are that fsck (or e3fsck) will fail as well. You can tell e3fsck to use one of the superblock copies, instead, to repair the filesystem. The command is:
e3fsck -f -b offset device
where offset is the block offset to a superblock copy; usually, this is 8193. The -f switch is used to force a check of the filesystem; when using superblock backups, the filesystem may appear "clean," in which case no check is needed. -f overrides this. For example, to repair the filesystem on /dev/hda2 with a bad superblock, we can say:
e3fsck -f -b 8193 /dev/hda2
Superblock copies save the day. The previous commands can be executed from an emergency floppy system and will hopefully allow you to mount your filesystems again.
Now that journaling filesystems such as ext3, reiserfs (the Reiser filesystem), and jfs come with most Linux distributions by default, it is very unlikely that you will ever have to resort to the superblock-wrangling tricks just described. Because of the "journal," which is a log kept internally by the filesystem of all changes as they are made, modern filesystems are quite resistant to superblock damage. Still, it can happen, and it's good to know how to recover from it easily, without having to rebuild your entire filesystem.
Accessing Damaged Files
You might need to access the files on your hard drive filesystems when booting from an emergency floppy or CD-ROM. To do this, simply use the mount command as described in "Mounting Filesystems" in Chapter 10, mounting your filesystems under a directory such as /mnt. (This directory must exist on the root filesystem contained on the rescue disk.) For example,
mount -t ext3 /dev/hda2 /mnt
will