Puppy Linux Discussion Forum

[jhhauman]

I have just had a USB flash drive die on me. Managed, using dd, to get some data off it, and now need the header for a .3fs so that I can use either photorec or foremost or scalpel to get my warysave.3fs file back. The ironic thing is that I've been emailing myself a copy of the file every time I log off my laptop, deleting the old one when the new one arrives in my inbox. This time the file was already corrupting when I sent it so it's unusable (and the "header" is line after line of @ symbols). Any help would be really appreciated!

[darkcity]

I've not been able to find out much about 2fs and 3fs other than they are 'filing systems in a file', the systems used been linux ext2 and ext3 respectably. I don't 2fs and 3fs are linux standard extension, but something Barry designed, any more info anyone?

there is a command for repairing these file systems, its e2fsck (file system shouldn't be in use when checked)

see-
http://www.murga-linux.com/puppy/viewtopic.php?t=70265

[jhhauman]

Thanks for the reply darkcity.
What I'm looking for is the signature of a .3fs file.
The basic idea on how to do this is explained here:
http://www.thelinuxdoctor.org/Articles/Foremost.html
and then how to use it:
http://www.4n6k.com/2012/01/forensics-quickie-recovering-deleted.html
If I run "strings" on a .sfs file I find that all of them start with "hsqs".
I'm obviously hoping that a .3fs files will have something like this that can be used by photorec / foremost / scalpel, but as I don't have an uncorrupted copy of one I'm a little stuck, and am having to hope that some Wary user out there has a few warysave.3fs files that they can run through "strings" and see if there is a common signature I can use.

[darkcity]

Unfortunately I don't use Wary or 3fss.

did you e2fsck, it can fix corrupted files?

[jhhauman]

e2fsck complains about a bad superblock and dies!