Posted Oct 11, 2011 22:37 UTC (Tue) by terryburton (subscriber, #26261)
In reply to: Whither btrfsck? by raven667
Parent article: Whither btrfsck?
On more that one occasion I have performed recoveries on corrupt filesystems of multi-user *nix boxes. (Think of Computer Science students keen to explore the latest kernel exploits against a teaching/research box...)
In severe circumstances the safest approach is usually to image the damaged filesystem to a different host, restore the live system from a trusted backup, let the users back in, then to perform the actual data recovery offline (fsck + debugfs) - restoring only the recovered content that users actually request or is full trusted (e.g. file checksums in btrfs.) This balances the need for access to fresh data against the risk of rouge data appearing into other users' files or latent corruption remaining in the recovered filesystem that may result in future data loss or crashes.
For the more routine, periodic checks that should be performed online (check interval expired, mount count exceeded, etc.) you had better trust your tools.