Repair a corrupted Linux files-ystem

[Aerosol]

Fsck utility

Filesystem on Linux OS or any other OS in some situations can get corrupted. This can happen due to reasons like abnormal shutdown, hardware malfunctioning, switching off the system without proper shutdown procedure or power failure. Due to these reasons the superblock in a file system is not correctly updated and has mismatched information relating to system data blocks, free blocks and inodes.

A corrupted Linux filesystem can be repaired with the program called "fsck". The system utility fsck "file system check" or "file system consistency check" is a tool for checking the consistency of a file system in Linux and Unix-like operating systems.

( Important: Before any action is taken, File systems must be unmounted. It's not possible to repair the filesystem while it's running because it's changing constantly and fsck may see those changes as inconsistencies and may corrupt the file system even more. Fsck should always be run in a single user mode. Running fsck on a mounted filesystem could do SEVERE damage.)

FSCK options overview:

• -f switch - force the file system check regardless of its clean flag
  
• -p switch - fixes minor problems without user interaction (safe repair during the booting process)
  
• -y switch - gives permission to correct every problem found without users interaction
  
• -n switch - indicates to only search (and not correct) problems
  
• -b=n - n is the number of next super block if primary super block is corrupted in a filesystem
  

fsck checks the filesystem in 5 phases:

• phase 1 – Check Blocks and it's Sizes
  
• phase 2 – Check Pathnames
  
• phase 3 – Check Connectivity
  
• phase 4 – Check Reference Counts
  
• phase 5 – Check Cylinder Groups
  

The most simple variant to run fsck is to force fsck on restart, and then restart your system:

LinuxBox# touch /forcefsck 

or

LinuxBox# shutdown -rF now

Command to check corrupted and unmounted filesystem would simply be fsck /dev/xxx where /dev/xxx is corrupted partition or filesystem:

LinuxBox# fsck /dev/sda1

Another option is to swich the system to runlevel 1, to log-out any users, unmount all partitions and run fsck. After repair, remount all drives and continue to runlevel to 3:

1) Take system down to runlevel one (single user-mode):

 LinuxBox# init 1

(all commands should be run as root user)

2) Unmount file system, for example if it is /dev/sda3 file system then type command:

LinuxBox# umount /dev/sda3

3) Run fsck on the partition:

LinuxBox# fsck -t ext3 /dev/sda3

(Specify the file system type using -t option. By default, fsck assumes ext2 file system.

Notice: If you dont specify correct filesystem, result could be even more corruption.)

If don't know which filesystem type to define, You can use mount command which will display the type.

To check and repair file system without fsck asking any questions, use -y option:

LinuxBox# fsck -t ext3 -y /dev/sda3

(If any files are recovered, they are placed in /home/lost+found directory by fsck command.)

4) Once fsck finishes, file system can be remounted:

LinuxBox# mount /dev/sda3

5) switch to multiuser mode again:

LinuxBox# init 3

Here are also some of the fsck error messages & solutions:

1. Corrupted superblock – fsck fails to run

If the superblock is corrupted the file system still can be repaired using alternate superblock which are formed while making new file system:

 LinuxBox# newfs -N /dev/sda1/c0t0d0s3

The first alternate superblock number is 32 and others superblock numbers can be found. To run fsck using first alternate superblock following command can be used:

LinuxBox# fsck -F ufs -o b=32 /dev/rdsk/c0t0d0s3

2. Link counter adjustment

fsck can find mismatch between directory inode link counts and actual directory links and prompts for adjustment. Link count adjustments are considered to be a safe operation in a file system and should be repaired by giving ‘y’ response to the adjust ? prompt during fsck.

3. Free Block count salvage

During fsck the number of free blocks listed in a superblock and actual unallocated free blocks count does not match. fsck informs this mismatch and asks to salvage free block count to synchronize the superblock count. This error can be corrected without any potential problem to the file system or files.

4. Unreferenced file reconnection

While checking connectivity fsck can find some inodes which are allocated but not referenced – not attached to any directory. Answering y to reconnect message by fsck links these files to the lost+found directory with their inode number as their name. To get more info about the files in lost+found ‘file’ command can be used to see the type of files and subsequently they can be opened in their applications or text editors to find out about their contents. If the file is found to be correct it can be used after copying to some other directory and renaming it.

Source