# Advanced Find EXT2 EXT3 Backup SuperBlock

### From CGSecurity

If the EXT2/EXT3 primary superblock is damaged, the filesystem can not be mounted.

If the normal superblock is corrupted, fsck will search an alternative superblock but may failed to find one of them. The location of the backup superblocks are dependent on the filesystem's blocksize, this size is stored in the superblock, so it's not known while searching for backup superblock. To search them, running TestDisk, in the Advanced menu, select the partition and choose Superblock.

The superblock contains all the information about the configuration of the filesystem. The primary copy of the superblock is stored at an offset of 1024 bytes from the start of the partition, and it is essential to mounting the filesystem. Since it is so important, backup copies of the superblock are stored in block groups throughout the filesystem. The first version of ext2 (revision 0) stores a copy at the start of every block group, along with backups of the group descriptor block(s). Because this can consume a considerable amount of space for large filesystems, later revisions can optionally reduce the number of backup copies by only putting backups in specific groups (this is the sparse superblock feature). The groups chosen are 0, 1 and powers of 3, 5 and 7.

Now using the value given by TestDisk, you can use fsck to repair your ext2/ext3 filesystem. Ie if TestDisk has found a superblock at block number 24577 and a blocksize of 1024 bytes, run

    /sbin/fsck.ext3 -b 24577 -B 1024 /dev/hda1

Back to Running the TestDisk Program

Category: Data Recovery

##### Data Recovery

- TestDisk
- PhotoRec
- download