Recovering after (stupidly) running mkswap on my ext3 partition

A Tech article with View Comments posted 9 March 2007.
Tags: ext3, mkswap, recovery

Disclaimer: it’s not my fault if you lose all your data. Follow these instructions at your own risk.

After upgrading from Ubuntu Dapper to Edgy, I noticed that my swap partition wasn’t mounted. I ran mkswap /dev/sda2 and continued on my merry way. The system seemed fine for a little while, but then I couldn’t write to any files. Upon rebooting, grub gave me error code 17. Oops – wrong partition!

I booted a Ubuntu Edgy Live CD, then downloaded TestDisk,
an open-source low-level disk analyzer. I used it to analyze the broken partition, and located the backups my ext3 filesystem made of the superblocks:

superblock 32768, blocksize=4096
superblock 98304, blocksize=4096
superblock 163840, blocksize=4096
…etc…

Being a good Boy Scout, I was prepared, having relatively recent backups. If you don’t have backups, you should probably use some incantation of dd to backup an image of your partition first.

Using the superblock information, I ran fsck.ext3 in a non-destructive mode like so: sudo /sbin/fsck.ext3 -n -v -b 32768 /dev/sda2 The -n flag means “answer no to every question,” which prevents any destructive writes to the disk. Flag -v means “verbose,” and “-b 32768″ tells fsck to use the superblock backup at block 32768. If you get a lot of errors (that you care about), try a different backup superblock.

If you’re satisfied that fsck can do the job safely (and if you’re not, it’s time to turn off the machine, pull the hard drive, and call a data recovery company), remove the -n flag (and add the -y flag if you’re really brave and want to answer “yes” to every question) and run fsck again. Cross your fingers. Run fsck one more time, this time non-destructively (with -n), to see if everything was fixed.

Now, if all has gone well, it’s time to mount the drive again, read-only, in a folder called /rescue: sudo mount -r -t ext3 /dev/sda2 /rescue. Now (hopefully) you’ve got your files back! Copy them someplace safe ASAP.