最後更新: 2020-04-23

前言

If the normal superblock is corrupted, fsck will search for an alternative superblock but may fail to find any of them.

The location of the backup superblocks are dependent on the filesystem's block size.

This size is stored in the superblock, so it isn't known while searching for the backup superblock.

magic number 0xEF53

The magic number is little-endian(Intel byte ordering). So the bytes appear in reverse order.

# 位置   magic        on disk
0x38    0xEF53   --> 53ef

簡易尋找

dd if=/dev/sdd bs=1M count=10 skip=0 | xxd | grep -E '53 ?ef'

List superblock on FS

The superblock contains all the information about the configuration of the filesystem.

The primary copy of the superblock is stored at an offset of 1024 bytes from the start of the partition

backup copies of the superblock are stored in block groups throughout the filesystem

stores a copy at the start of every block group, along with backups of the group descriptor block(s).

The groups chosen are 0, 1 and powers of 3, 5 and 7

(Its location is fixed and it contains the basic file system information.)

We can dump its contents with "dumpe2fs -h DEV" option prints only the Superblock.

[方法1]

To search for them, run TestDisk and in the "Advanced menu", select the partition and choose "Superblock".

[方法2]

mkfs.ext4 -n /dev/myraidvg/MyBackup.Snap

mke2fs 1.44.5 (15-Dec-2018)
Creating filesystem with 805306368 4k blocks and 201326592 inodes
Filesystem UUID: 44623ce7-46af-4532-bb94-7a45fe363082
Superblock backups stored on blocks:
        32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
        4096000, 7962624, 11239424, 20480000, 23887872, 71663616, 78675968,
        102400000, 214990848, 512000000, 550731776, 644972544

Remark

A)

Block Size for Ext4 can be 1Kb to 64Kb

B)

/etc/mke2fs.conf

[defaults]
        base_features = sparse_super,large_file,filetype,resize_inode,dir_index,ext_attr
        
[fs_types]
        ext4 = {
                features = has_journal,extent,huge_file,flex_bg,metadata_csum,64bit,dir_nlink,extra_isize
                inode_size = 256
        }

sparse_super

將superblock 稀疏地分散在文件系統中：既不是每個塊組都有superblock

用檢視到的備份 superblock 來 mount /dev/sda2

# sb=n   Instead of block 1, use block n as superblock.

# This could be useful when the filesystem has been damaged.

mount -o sb=32768   /dev/sda2  /mnt/tmp

Repair with another superblock

/sbin/fsck.ext4 -b 32768 -B 4096 /dev/myraidvg/MyBackup_snap

e2fsck 1.44.5 (15-Dec-2018)
Superblock has an invalid journal (inode 8).
Clear<y>? yes
*** journal has been deleted ***

Resize inode not valid.  Recreate<y>? yes
Pass 1: Checking inodes, blocks, and sizes
Root inode is not a directory.  Clear<y>? yes