alt.os.linux - Help - lost partition data...

Author

Help - lost partition data...

graham

2002-10-04, 5:25 pm

Hi -

I've a system with a SCSI drive for system data, and a larger IDE drive
for central data storage on a small network - both
motherboard IDE channels died this morning, crashing the machine, and
leaving it unable to recognise IDE devices. On reboot, I
ran fsck, and now have the IDE drive as a slave on another machine, but
while the BIOS recognises it, the partition table seems
to have been wiped - fdisk reports "unable to open hdb", fsck gives
"Invalid argument" and "superblock could not be read" messages - I've
tried the alternate superblocks reported with no luck.

From Google, I saw a pointer to bpe, have now installed it, but don't
know what I'm actually looking for to recreate the original partition
table data (or how to use bpe..).

Could anyone give me any clues how to recover the lost data using an
editor or any other means? I'm quite happy to spend time manually
searching, as although a fair amount is backed up until a week ago, one
set of directory backups was effectively mapped back onto the same disk,
so the backup is lost with the data (duh...).

Any help would be much appreciated,

Graham

don_pettengill@spamgilent.com

2002-10-04, 6:25 pm

graham <graham.smith@allott.org> wrote:

: Could anyone give me any clues how to recover the lost data using an
: editor or any other means? I'm quite happy to spend time manually

I can't help with that. However you may be able to "dd" the drive
contents off the raw device into a file (on a much larger good disk,
obviously). If so then you can quickly experiment on a copy of the file
and if you trash it, get another copy and try again. If you manage to
fix it you will be able to loop mount that disk image file and retrieve
your data. I would not risk doing anything with the physical disk
unless there's no other choice. Reading the disk image with dd should
be safe enough. If you can't do at least that then I suspect you are in
deep doo-doo :-)

"This advice worth what was paid for it" :-)

Don Pettengill
Agilent Laboratories

Richard Adams

2002-10-05, 3:25 am

In article <3D9E1EFA.AA7A53D6@allott.org>, "graham"
<graham.smith@allott.org> wrote:

> Hi -
>
> I've a system with a SCSI drive for system data, and a larger IDE drive
> for central data storage on a small network - both motherboard IDE
> channels died this morning, crashing the machine, and leaving it unable
> to recognise IDE devices. On reboot, I ran fsck, and now have the IDE
> drive as a slave on another machine, but while the BIOS recognises it,
> the partition table seems to have been wiped - fdisk reports "unable to
> open hdb", fsck gives "Invalid argument" and "superblock could not be
> read" messages - I've tried the alternate superblocks reported with no
> luck.

Lets clear up one thing first, you say you have the IDE drive placed on
another motherboard as slave, is that slave on the "primary" ide
interface or slave on the secondary interface.??
/dev/hdb = slave on the primary interface.
/dev/hdd = slave on the secondary interface.
If you knew that sorry i found it nessacary to explain.

Now lets presume your drive is /dev/hdb as you suggest.

The error message you are getting when doing;
fsck /dev/hdb
would be;
Parallelizing fsck version 1.22 (22-Jun-2001)
e2fsck 1.22, 22-Jun-2001 for EXT2 FS 0.5b, 95/08/09
Couldn't find ext2 superblock, trying backup blocks...
/sbin/e2fsck: Bad magic number in super-block while trying to open /dev/hdb

The superblock could not be read or does not describe a correct ext2
filesystem. If the device is valid and it really contains an ext2
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
e2fsck -b 8193 <device>

That is to be expected, fsck does not handle the "WHOLE" device,

you need to use;

fsck /dev/hdbn
Where "n" is the partition number.

If a IDE interface dies on you like you say, then it itself dies, it does
not kill your hard disks, it may however have corrupoted any open files,
but the damage will possably be small and reapirable with the correct
fsck options.

Another thing to check is 'dmesg' it will tell you if the drive was
detected at bootime and show its partition details;
Some distro's save the output of dmesg to a file called "dmesg" in
/var/log/ dmesg is a running ring buffer which means if your machine has
been running a while then the startup details may not be seen anymore,
the actual command is 'dmesg'

>
> From Google, I saw a pointer to bpe, have now installed it, but don't
> know what I'm actually looking for to recreate the original partition
> table data (or how to use bpe..).
>
> Could anyone give me any clues how to recover the lost data using an
> editor or any other means? I'm quite happy to spend time manually
> searching, as although a fair amount is backed up until a week ago, one
> set of directory backups was effectively mapped back onto the same disk,
> so the backup is lost with the data (duh...).
>
> Any help would be much appreciated,
>
>
> Graham

--
Regards Richard
pa3gcu@zeelandnet.nl
http://people.zeelandnet.nl/pa3gcu/

graham

2002-10-05, 11:25 am

Don - thanks for the advice -

> However you may be able to "dd" the drive
> contents off the raw device into a file (on a much larger good disk,
> obviously). If so then you can quickly experiment on a copy of the file

The damaged disk is 30GB, and a friend's lending me a 60GB disk with
about 50GB
free to create a file. The 60 gig disk is FAT32 - presumably that's OK
to use
once mounted onto a Linux system, and there's no chance of damaging his
disk by
mistyping dd and editor commands?

I've read the man and info pages for dd, but am still not sure of the
exact syntax -
if you could explain, it'd be helpful, as I may have to leave the
machine on for ages
only to find it's done something unexpected. Is it just "dd /dev/hdb
<hddmountpoint>/<bigfilename>"?

Any idea what I'm looking for to identify superblock locations or
partition boundaries?

Regards

Graham

graham

2002-10-05, 11:25 am

Richard - thanks for the response.
>
> In article <3D9E1EFA.AA7A53D6@allott.org>, "graham"
> <graham.smith@allott.org> wrote:
>
<<Not quite all the details, to keep it brief>>

>
> Lets clear up one thing first, you say you have the IDE drive placed on
> another motherboard as slave, is that slave on the "primary" ide

The drive was set as hdb on both the original (failed) system and the
new one - the data I need
is on /dev/hdb6, the other partitions are leftover from a previously
undamaged Linux (RH 7.1)
installation on the drive.

The alternate superblocks were reported as
32768,98304,163840,229376...etc to 4096000. The man page
implied these may not be accurate unless the file system was created
with the -b option, ie the block
size specifically set. I've no idea on this; the RedHat 7.1 installer
(with partitions set manually) did it.

Running fsck /dev/hdb6 -b 163840 (also with any other, or no, superblock
specified) gives:

[me] # fsck /dev/hdb6 -b 163840
fsck 1.27 (8-Mar-2002)
e2fsck 1.27 (8-Mar-2002)
fsck.ext2: Invalid argument while trying to open /dev/hdb6

The superblock could not be read or does not describe a correct ext2
filesystem. If the device is valid and it really contains an ext2
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate
superblock:
e2fsck -b 8193 <device>

fdisk isn't much use, either
[me]# fdisk /dev/hdb

Unable to read /dev/hdb

> but the damage will possably be small and reapirable with the correct
> fsck options.

I hope so...

I'm sure if I can find the original partition start and finish details I
will be able to rewrite
the table and retrieve the data. But how??

On reboot, fsck ran automatically, but the boot failed, and dropped me
into a maintenance shell.
I then ran fsck manually, after the "severe damage to mounted
filesystem" message, first on sda
partitions, then on the hdb partitions (I'm sure hdb wasn't mounted at
the time), but it didn't
even run once on hdb, just gave error messages.

>
> Another thing to check is 'dmesg' it will tell you if the drive was
> detected at bootime and show its partition details;
> Some distro's save the output of dmesg to a file called "dmesg" in
> /var/log/ dmesg is a running ring buffer which means if your machine has
> been running a while then the startup details may not be seen anymore,
> the actual command is 'dmesg'
>

The dmesg output gives the following (or similar) repeated about 14
times:

hdb: read_intr: status=0x59 { DriveReady SeekComplete DataRequest Error
}
hdb: read_intr: error=0x04 { DriveStatusError }
hdb: read_intr: status=0x59 { DriveReady SeekComplete DataRequest Error
}
hdb: read_intr: error=0x04 { DriveStatusError }
hdb: read_intr: status=0x59 { DriveReady SeekComplete DataRequest Error
}
hdb: read_intr: error=0x04 { DriveStatusError }
hdb: read_intr: status=0x59 { DriveReady SeekComplete DataRequest Error
}
hdb: read_intr: error=0x04 { DriveStatusError }
ide0: reset: success

Then ends with:
hdb: read_intr: status=0x59 { DriveReady SeekComplete DataRequest Error
}
hdb: read_intr: error=0x04 { DriveStatusError }
end_request: I/O error, dev 03:40 (hdb), sector 6
unable to read partition table

I've downloaded Findext2, which attempts to find superblocks and
partition data, but it
only runs in a DOS box under Windoze, and Windoze 2k won't even
recognise the disk exists
(Control Panel - Component services - Storage etc..), and the program
can't find the disk.
This is the same machine as the good Linux one, with hda swapped for a
Win2k disk, so the BIOS
definitely finds the disk.

Anyone know of a Linux version of a similar program to Findext2?

In RedHat 7.3, KDE hardware browser, the disk just shows up as one big
solid green line, with
no partitions shown, but at leat it's there.

Regards,

Graham

Jon Portnoy

2002-10-05, 12:25 pm

In article <3D9F1794.2113754B@allott.org>, graham wrote:
> Don - thanks for the advice -
>
>> However you may be able to "dd" the drive
>> contents off the raw device into a file (on a much larger good disk,
>> obviously). If so then you can quickly experiment on a copy of the file
>
>
> The damaged disk is 30GB, and a friend's lending me a 60GB disk with
> about 50GB
> free to create a file. The 60 gig disk is FAT32 - presumably that's OK
> to use
> once mounted onto a Linux system, and there's no chance of damaging his
> disk by
> mistyping dd and editor commands?
>
> I've read the man and info pages for dd, but am still not sure of the
> exact syntax -
> if you could explain, it'd be helpful, as I may have to leave the
> machine on for ages
> only to find it's done something unexpected. Is it just "dd /dev/hdb
><hddmountpoint>/<bigfilename>"?
>

dd if=/dev/<device> of=<filename> will copy /dev/<device> to <filename>.

--
Jon Portnoy

Bruce Burhans

2002-10-05, 2:25 pm

"graham" <graham.smith@allott.org> wrote in message
news:3D9F1794.2113754B@allott.org...
> Don - thanks for the advice -
>
> > However you may be able to "dd" the drive
> > contents off the raw device into a file (on a much larger good disk,
> > obviously). If so then you can quickly experiment on a copy of the file
>
>
> The damaged disk is 30GB, and a friend's lending me a 60GB disk with
> about 50GB
> free to create a file. The 60 gig disk is FAT32 - presumably that's OK
> to use
> once mounted onto a Linux system, and there's no chance of damaging his
> disk by
> mistyping dd and editor commands?
>
> I've read the man and info pages for dd, but am still not sure of the
> exact syntax -
> if you could explain, it'd be helpful, as I may have to leave the
> machine on for ages
> only to find it's done something unexpected. Is it just "dd /dev/hdb
> <hddmountpoint>/<bigfilename>"?
>
> Any idea what I'm looking for to identify superblock locations or
> partition boundaries?
>
> Regards
>
> Graham
>

dd if=/full/path/to/inputfile of=/ibid/outputfile \ bs=?? (8192 is
good, usually

Bruce<+>

graham

2002-10-05, 6:44 pm

Jon Portnoy wrote:
>
> dd if=/dev/<device> of=<filename> will copy /dev/<device> to <filename>.
>
dd just gives an I/O error -

[me]# dd if=/dev/hdb of=/mnt/big/data
dd: reading `/dev/hdb': Input/output error
0+0 records in
0+0 records out

Which may not be as hopeless as it seems - surely for dd not to
recognise the disk something extreme should have happened, yet it was
the motherboard IDE channel that failed, and the disk is only a few
months old...

Could the BIOS be getting the autodetected settings wrong, making the
disk unuseable?

The hardware browser gives geometry of 59560/16/63 for the disk, and the
label seems close with LBA, CHS:16383/16/63. I've tried the disk on a
different m/board, tryng each of the LBA, normal and large autodetected
settings, and it won't attempt to boot from the disk.

Thanks for the dd syntax,

Regards,

Graham

graham

2002-10-05, 6:44 pm

Bruce Burhans wrote:
>
> dd if=/full/path/to/inputfile of=/ibid/outputfile \ bs=?? (8192 is
> good, usually

Tried it with 8192, 16383 & 16384 (16383 is mentoned on the label), but
just the same as before.

dd if=/dev/hdb of=/mnt/big/data \bs=16384
dd: reading `/dev/hdb': Input/output error
0+0 records in
0+0 records out

Thanks anyway,

Graham

Sponsored Links