Video Screencast Help
Security Community Blog

Recovering corrupted Linux system after “fscking” a mounted system

Created: 05 May 2010
mariapeter12's picture
+1 1 Vote
Login to vote

In the Linux operating system, fsck is a useful utility that scans the file system for consistency and integrity and on finding errors repairs them. It usually runs automatically at the time of startup if the system detects that the file system is in an inconsistent state. This utility runs both in interactive and non-interactive mode. Although this utility is pretty useful, at times it may backfire as well. For example, if you run fsck on a mounted Linux system then it could lead to system corruption and data loss. In such cases, you should use a third-party Linux data recovery software to recover lost data from corrupted file system.

Consider a scenario wherein you are working on a Linux system that has live ext3 file system. You run the fsck utility and find the following error message:

“EXT3-fs: corrupt root Inode, run e2fsck”

If you run e2fsck on the same volume after getting the aforementioned error message, then the following error message is displayed:

“Root Inode is not a directory. Clear?”

Select either “Yes” or “No” when you get this error message. If you select “Yes”, then the parent entry of each Inode in the root directory is removed and the following message is displayed:

“Missing '..' in directory Inode”

Now, you need to find the root cause of the problem.

Cause:
The root cause of the corruption in the file system is that you have used the fsck utility on the mounted Linux system. Once this happens, the system is unable to boot and the data becomes inaccessible.

Resolution
To resolve this issue, you should replace the existing file system. For this, you would need to format the existing system and reinstall Linux system. However, in that case you will not be able to retrieve valuable data. So, to repair the file system and to recover trapped data you need to use a third-party Linux recovery software to perform data recovery of Linux system. These tools are highly interactive and read-only in nature.

More Info is available at http://www.data-recovery-linux.com