| View previous topic :: View next topic |
| Author |
Message |
Ctrl+Alt+Del
Guru
Joined: 04 Jul 2004
Posts: 323
Location: .de
|
 Posted: Sat Sep 13, 2008 1:18 pm Post subject: [SOLVED] Recover ext3 volume? |
 |
|
Hi Folks,
i just wanted to mount my old hd copying my old home to my new box, but retarded as i am i did a mkdir /dev/hdc11 (which is my old home), anyone got an idea how to recover that?
Last edited by Ctrl+Alt+Del on Sat Sep 13, 2008 3:20 pm; edited 1 time in total |
|
| Back to top |
|
 |
NeddySeagoon
Administrator
Joined: 05 Jul 2003
Posts: 21675
Location: 56N 3W
|
| Posted: Sat Sep 13, 2008 1:36 pm Post subject: |
|
|
Ctrl+Alt+Del,
mkdir /dev/hdc11 ? or mkfs ? The difference is critical.
If its the former, you have trashed the primary superblock, which is no real hardship as there are backup superblocks.
The latter writes a new filesystem, which if it is identical to the old filesystem, is the same as unliklink all your files withuot harming the data.
Thats much harder to recover.
Which one is it ?
_________________
Regards,
NeddySeagoon
Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail. |
|
| Back to top |
|
|
Ctrl+Alt+Del
Guru
Joined: 04 Jul 2004
Posts: 323
Location: .de
|
| Posted: Sat Sep 13, 2008 1:40 pm Post subject: |
|
|
| mkdir for sure, i wanted to create a mountpoint for it under /mnt/ ... |
|
| Back to top |
|
|
NeddySeagoon
Administrator
Joined: 05 Jul 2003
Posts: 21675
Location: 56N 3W
|
| Posted: Sat Sep 13, 2008 2:02 pm Post subject: |
|
|
Ctrl+Alt+Del,
Read | Code: | man mount
man e2fsck |
before you do this. The numbers may not be right for you.
What this does is to mount the partition, read only, using one of the backup superblocks.
You should try | Code: | | mount -o ro,sb=n -t ext3 /dev/hdc11 /mnt/some/mountpoint |
| Code: | sb=n Instead of block 1, use block n as superblock. This could be useful when the filesystem has been damaged. (Earlier, copies of the
superblock would be made every 8192 blocks: in block 1, 8193, 16385, ... (and one got thousands of copies on a big filesystem). Since
version 1.08, mke2fs has a -s (sparse superblock) option to reduce the number of backup superblocks, and since version 1.15 this is the
default. Note that this may mean that ext2 filesystems created by a recent mke2fs cannot be mounted r/w under Linux 2.0.*.) The block
number here uses 1k units. Thus, if you want to use logical block 32768 on a filesystem with 4k blocks, use "sb=131072". |
sb=131072 may even work for you.
The read only option is important - it stops you doing further damage and allows you to read the files once your mount works.
Don't allow any changes to be made to the filesystem until you have recovered your data or made an image, so you have an undo facility.
_________________
Regards,
NeddySeagoon
Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail. |
|
| Back to top |
|
|
Ctrl+Alt+Del
Guru
Joined: 04 Jul 2004
Posts: 323
Location: .de
|
| Posted: Sat Sep 13, 2008 3:02 pm Post subject: |
|
|
Ok, this is getting somewhat messy..
trying to mount it ro with sb=131072 tells me it is not a valid block device... which i find a bit puzzling... should it tell me sth. along the lines of unkown filesystem?
The way i see it.. mkfs.ext3 manual says the blocksize is dynamically chosen depending on the size of the disk.. so i currently do not know which blocksize i have which makes guessing for the right sb a tad harder...
Tbh the whole relation between cylinders, sectors and blocks is something of mystery to me...
The drive is layouted as follows:
| Code: | Disk /dev/hdc: 250.0 GB, 250059350016 bytes
255 heads, 63 sectors/track, 30401 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x040984ec
Device Boot Start End Blocks Id System
/dev/hdc1 * 1 1868 15004678+ 7 HPFS/NTFS
/dev/hdc2 1869 30401 229191322+ 5 Extended
/dev/hdc5 1869 2240 2988058+ 7 HPFS/NTFS
/dev/hdc6 2241 2258 144553+ 83 Linux
/dev/hdc7 2259 6537 34371036 83 Linux
/dev/hdc8 6538 6661 995998+ 83 Linux
/dev/hdc9 6662 9733 24675808+ 7 HPFS/NTFS
/dev/hdc10 9734 14340 37005696 7 HPFS/NTFS
/dev/hdc11 14341 30401 129009951 83 Linux
|
So if i were to sum all the blocks up to hdc10 up i can take this number, add Number X (according to http://www.cgsecurity.org/wiki/Advanced_Find_ext2_ext3_Backup_SuperBlock ) and use that superbblock to mount it...?
unfortunately i have to clue how to find X...
btw. testdisk says it's unrecoverable...
edit: using testdisk i can browse the drive and copy stuff of it... so i am currently copying all the stuff over to my hd at insane speeds... (<1mb/s), thx a lot for your help NeddySeagoon |
|
| Back to top |
|
|
NeddySeagoon
Administrator
Joined: 05 Jul 2003
Posts: 21675
Location: 56N 3W
|
| Posted: Sat Sep 13, 2008 5:30 pm Post subject: |
|
|
Ctrl+Alt+Del,
The filesystem allocation unit size is either 1k, 2k, or 4k, so guessing a sb= should only take 3 goes, providing you know where a valid superblock is. The very risky method in the man page is only useful if you know how the filesystem was made.
| Code: | 255 heads, 63 sectors/track, 30401 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes |
In days of old when 4G was a huge drive, most systems used what is called teh Cylinder, Head and Sector (CHS)addressing method to find data on the drive. The Cylinder being a count of tracks (from zero) from the outside of the drive, the Head being used to select which surface of which platter the data was on and the sector now far round the disk from the datum, the data was. Today, we use Logical Block Addressing and the drive works out where to find the data. Modern drives don't even have a fixed geometery, they are zoned, so as the distance around the edge is further, you can get more sectors per track than at the inside. Thats detectable as the data transfer rate drops closer to the spindle.
For backwards compatibility, drives perpetuate the myth of geometery.
Modern drives always claim 255 heads, 63 sectors/track, which gives you Units = cylinders of 16065 * 512 = 8225280 bytes.
As there is a historical rule that says partitions should begin on a cylinder boundary (nobody cares today) partitions are normally sized in 8225280 byte steps, fdisk enforces the rule, other tools do not.
Lets take / | Code: | | dev/hdc8 6538 6661 995998+ 83 Linux |
as a worked example
It contains 6661-6538+1 cylinders (the numbers are inclusive) of 8225280 bytes for a total of 1019934720 bytes.
It also contains 995998 1k blocks ... the numbers don't quite balance.
Do not use fsck on a damaged filesystem until you have an image of it. It often makes things worse, not better.
If you know a valid superblock, from running testdisk, use the number as is in the sb= paramater to mount.
That will be correct for a 1k block size. if that fails, divide it by two, if you don't get an integer, there is something wrong. That number will be correct for a 2k block size. Divide by 2 againing for a 4k block size. The worst that happens is error messages from mount.
To add to the interest, I'm not sure if things count from 0 or count from 1. So add 1 to the number that testdisk gave you ant try again
_________________
Regards,
NeddySeagoon
Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail. |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Other Things Gentoo
