Blogs Blogs

« Back

GFS2 unformat helper tool - #1

Reformatting cluster based volume is specially bad news. BTW we received this news and been forced to return our data. After read of this thread we could write a program to help us to unformat the volume and return our data.

Some good news:

  1. File-system was gsf2 not ext3 ;-)
  2. No data re-write
  3. We do not run "gfs2_grow"
  4. Good help form list especially bob
  5. Format options and parameters also was the same

Its seems that we were lucky!

How it works:
GFS2 segments volume blocks to Resource-Groups(RG),  RG has bitmaps that stores blocks states that can be one of the following states:
Formatting GFS2 volume causes changing of all states of blocks (other than GFS2 reserved blocks) to 0, means all is free.

This program tries to find "dinode " blocks(by block allocation type) and marks them in RG-bitmap as metadata(DINODE). DInodes store inode information about volume files, so when we mark them as "DINODE", fsck would be able to find data blocks and fix their states in RG-bitmap as “USED” so all data would be recovered.


Special thanks to "Bob Peterson" that guides us to this solution.

This program recovered our data (about 1.7 TB) without even one bit lost in less than 2 hour (1hour for this program and 1 our for fsck).

As far as we didn't have enough time to write nice and full automated code, this program is simple and all of its parameters defined as macro, so for personal use you have to change program macros according to your environment. Program needs some  verification to retrieve GFS2 metadata from disk.

We will try to improve this program in future versions.

How to use:

  1. Get the code from here
  2. First step to recover volume is backup from reformatted volume through “dd”:
    dd if=/dev/reformatted/volume of=/dev/backup/volume bs=1M
  3. Change program parameters that defined as macroes.
  4. Compile the program: g++ gfs2_unformat-ver*.*.*.cpp -o unformat
  5. Run the program: ./unformat
  6. Run fsck on volume: fsck.gfs2 -fy /path/to/volume
    fsck would generate huge number of messages.
Previous Next