From owner-freebsd-hackers Mon Feb 17 06:38:52 1997 Return-Path: Received: (from root@localhost) by freefall.freebsd.org (8.8.5/8.8.5) id GAA18362 for hackers-outgoing; Mon, 17 Feb 1997 06:38:52 -0800 (PST) Received: from Campino.Informatik.RWTH-Aachen.DE (campino.Informatik.RWTH-Aachen.DE [137.226.116.240]) by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id GAA18353 for ; Mon, 17 Feb 1997 06:38:48 -0800 (PST) Received: from gilberto.physik.rwth-aachen.de (gilberto.physik.rwth-aachen.de [137.226.31.2]) by Campino.Informatik.RWTH-Aachen.DE (RBI-Z-5/8.6.12) with ESMTP id PAA14667; Mon, 17 Feb 1997 15:39:04 +0100 (MET) Received: (from kuku@localhost) by gilberto.physik.rwth-aachen.de (8.8.4/8.6.9) id PAA24698; Mon, 17 Feb 1997 15:43:05 +0100 (MET) From: Christoph Kukulies Message-Id: <199702171443.PAA24698@gilberto.physik.rwth-aachen.de> Subject: Re: File system/disk recovery tools ? In-Reply-To: <199702171320.XAA11522@genesis.atrad.adelaide.edu.au> from Michael Smith at "Feb 17, 97 11:50:14 pm" To: msmith@atrad.adelaide.edu.au (Michael Smith) Date: Mon, 17 Feb 1997 15:43:04 +0100 (MET) Cc: luigi@labinfo.iet.unipi.it, msmith@atrad.adelaide.edu.au, hackers@FreeBSD.ORG Reply-To: Christoph Kukulies X-Mailer: ELM [version 2.4ME+ PL28 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-hackers@FreeBSD.ORG X-Loop: FreeBSD.org Precedence: bulk > Luigi Rizzo stands accused of saying: > > > dd the whole disk off onto a file and mount it on a vnode? You might > > > > unfortunately is 1.6GB ... I need to find a bigger unit! > > dd bits of it at a time? 8) > > > > have to reconstruct the label and such, and using fsck's '-b' option > > > > actually an annoying thing with fsck -b is that I never know what > > to use as an alternate superblock number. 32, says the manpage, is > > an alternate superblock, but what are others ? I guess they depend > > upon the geometry of the disk... is there a "magic" number that I > > can look for ? > > You mean you didn't write them down when you made your filesystems? 8) > > Ok, presumably your disklabel is OK. Have a look in /sys/ufs/ffs/fs.h > at the superblock layout; it's 8K long, has a fixed checksum, and > contains various predictable fields (eg. the last mountpoint). This > should let you hunt a copy of it down. Some time ago I wrote a (really quick and dirty) little program which scanned the disk for once existing file systems. It's too dirty to post in public but if anyone wants it I'll send it. At least one case beside of my own is known to have been successful. Bottomline is that you scan the disk for a FS magic and then with the obtained data (offset and size) you do a dd skip= count= to a file which then can be used as /dev/vn0 to be mounted and files can be restored from there. > > > Luigi Rizzo | Dip. di Ingegneria dell'Informazione > > > -- > ]] Mike Smith, Software Engineer msmith@gsoft.com.au [[ > ]] Genesis Software genesis@gsoft.com.au [[ > ]] High-speed data acquisition and (GSM mobile) 0411-222-496 [[ > ]] realtime instrument control. (ph) +61-8-8267-3493 [[ > ]] Unix hardware collector. "Where are your PEZ?" The Tick [[ > -- Chris Christoph P. U. Kukulies kuku@gil.physik.rwth-aachen.de