How to undo fsck operations performed on the Ext4 filesystem

Undo undo fsck operations performed on the Ext4 filesystem.

I will undo fsck operation on ext4 filesystem located on the /dev/sdb1 device.

$ blk -o NAME,FSTYPE,UUID /dev/sdb1
NAME FSTYPE UUID
sdb1 ext4   68eebaf9-0d11-45ed-a75c-6fdc44e4c8

Dry-run fsck to get summary information.

$ sudo fsck.ext4 -nvf /dev/sdb1
e2fsck 1.44.5 (15-Dec-2018)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information
          12 inodes used (0.02%, out of 65536)
           0 non-contiguous files (0.0%)
           0 non-contiguous directories (0.0%)
             # of inodes with ind/dind/tind blocks: 0/0/0
             Extent depth histogram: 4
        9225 blocks used (3.52%, out of 261883)
           0 bad blocks
           1 large file
           0 regular files
           3 directories
           0 character device files
           0 block device files
           0 fifos
           0 links
           0 symbolic links (0 fast symbolic links)
           0 sockets
------------
           3 files

Inspect files on the /dev/sdb1 device.

I am using tee to display output directly to the terminal.

$ sudo debugfs -R "ls -l /" /dev/sdb1 | tee
debugfs 1.44.5 (15-Dec-2018)
      2   40755 (2)      0      0    4096 10-Nov-2019 02:41 .
      2   40755 (2)      0      0    4096 10-Nov-2019 02:41 ..
     11   40700 (2)      0      0   16384 10-Nov-2019 02:41 lost+found
     12   40755 (2)      0      0   1499136 10-Nov-2019 03:18 huge_directory

Use fsck to modify filesystem and create e2fsck-device.e2undo undo file.

$ sudo fsck.ext4 -Dvf -z e2fsck-device.e2undo /dev/sdb1
e2fsck 1.44.5 (15-Dec-2018)
Overwriting existing filesystem; this can be undone using the command:
    e2undo e2fsck-device.e2undo /dev/sdb1
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 3A: Optimizing directories
Pass 4: Checking reference counts
Pass 5: Checking group summary information
/dev/sdb1: ***** FILE SYSTEM WAS MODIFIED *****
          12 inodes used (0.02%, out of 65536)
           0 non-contiguous files (0.0%)
           0 non-contiguous directories (0.0%)
             # of inodes with ind/dind/tind blocks: 0/0/0
             Extent depth histogram: 4
        8860 blocks used (3.38%, out of 261883)
           0 bad blocks
           1 large file
           0 regular files
           3 directories
           0 character device files
           0 block device files
           0 fifos
           0 links
           0 symbolic links (0 fast symbolic links)
           0 sockets
------------
           3 files

Inspect files on the /dev/sdb1 device.

$ sudo debugfs -R "ls -l /" /dev/sdb1 | tee
debugfs 1.44.5 (15-Dec-2018)
      2   40755 (2)      0      0    4096 10-Nov-2019 02:41 .
      2   40755 (2)      0      0    4096 10-Nov-2019 02:41 ..
     11   40700 (2)      0      0   16384 10-Nov-2019 02:41 lost+found
     12   40755 (2)      0      0    4096 10-Nov-2019 03:18 huge_directory

Inspect the header of the undo file.

$ sudo e2undo -h e2fsck-device.e2undo /dev/sdb1
nr keys:        9
super block:    1
key block:      2
block size:     4096
fs block size:  4096
super crc:      0x0
state:          0x1
compat:         0x0
incompat:       0x0
rocompat:       0x0
header crc:     0x67a4bdec

Dry-run undo operation.

$ sudo e2undo -nv e2fsck-device.e2undo /dev/sdb1
Replayed block of size 4096 from 18 to 0
Replayed block of size 4096 from 17 to 1
Replayed block of size 16384 from 11 to 129
Replayed block of size 4096 from 15 to 134
Replayed block of size 4096 from 16 to 136
Replayed block of size 4096 from 4 to 145
Replayed block of size 20480 from 5 to 4241
Replayed block of size 4096 from 10 to 4247
Replayed block of size 4096 from 3 to 65536

Perform undo operation.

$ sudo e2undo -v e2fsck-device.e2undo /dev/sdb1
Replayed block of size 4096 from 18 to 0
Replayed block of size 4096 from 17 to 1
Replayed block of size 16384 from 11 to 129
Replayed block of size 4096 from 15 to 134
Replayed block of size 4096 from 16 to 136
Replayed block of size 4096 from 4 to 145
Replayed block of size 20480 from 5 to 4241
Replayed block of size 4096 from 10 to 4247
Replayed block of size 4096 from 3 to 65536

Inspect files on the /dev/sdb1 device.

$ sudo debugfs -R "ls -l /" /dev/sdb1 | tee
debugfs 1.44.5 (15-Dec-2018)
      2   40755 (2)      0      0    4096 10-Nov-2019 02:41 .
      2   40755 (2)      0      0    4096 10-Nov-2019 02:41 ..
     11   40700 (2)      0      0   16384 10-Nov-2019 02:41 lost+found
     12   40755 (2)      0      0   1499136 10-Nov-2019 03:18 huge_directory

Additional notes

You cannot overwrite existing undo file.

$ sudo fsck.ext4 -Dvf -z e2fsck-device.e2undo /dev/sdb1
e2fsck 1.44.5 (15-Dec-2018)
Overwriting existing filesystem; this can be undone using the command:
    e2undo e2fsck-device.e2undo /dev/sdb1
fsck.ext4: Wrong undo file for this filesystem while trying to open /dev/sdb1
The superblock could not be read or does not describe a valid ext2/ext3/ext4
filesystem.  If the device is valid and it really contains an ext2/ext3/ext4
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
    e2fsck -b 8193 <device>
 or
    e2fsck -b 32768 <device>

You cannot safely undo fsck operations on a modified filesystem.

$ sudo e2undo -v e2fsck-device.e2undo /dev/sdb1
The file system superblock doesn't match the undo file.
Last mount time does not match.
Last write time does not match.
Lifetime write counter does not match.

Additional notes#

Additional notes