From owner-freebsd-questions@FreeBSD.ORG Wed Feb 14 01:54:13 2007 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 0E44E16A402 for ; Wed, 14 Feb 2007 01:54:13 +0000 (UTC) (envelope-from jerrymc@gizmo.acns.msu.edu) Received: from gizmo.acns.msu.edu (gizmo.acns.msu.edu [35.8.1.43]) by mx1.freebsd.org (Postfix) with ESMTP id D4EB713C428 for ; Wed, 14 Feb 2007 01:54:12 +0000 (UTC) (envelope-from jerrymc@gizmo.acns.msu.edu) Received: from gizmo.acns.msu.edu (localhost [127.0.0.1]) by gizmo.acns.msu.edu (8.13.6/8.13.6) with ESMTP id l1E1qN5c056460; Tue, 13 Feb 2007 20:52:23 -0500 (EST) (envelope-from jerrymc@gizmo.acns.msu.edu) Received: (from jerrymc@localhost) by gizmo.acns.msu.edu (8.13.6/8.13.6/Submit) id l1E1qNll056459; Tue, 13 Feb 2007 20:52:23 -0500 (EST) (envelope-from jerrymc) Date: Tue, 13 Feb 2007 20:52:22 -0500 From: Jerry McAllister To: Marty Landman Message-ID: <20070214015222.GD56231@gizmo.acns.msu.edu> References: <70063950702090446x712d7a94vb3b2a613a426d760@mail.gmail.com> <20070209152714.GA30383@gizmo.acns.msu.edu> <70063950702090906u1504a085j60dc7abc5121c28c@mail.gmail.com> <20070209202645.GA31381@gizmo.acns.msu.edu> <70063950702091348q49a9d997rc3dfcbb02b6375fc@mail.gmail.com> <20070212152526.GA48628@gizmo.acns.msu.edu> <70063950702121714w580120d9r4119f9ff7d9f4c9d@mail.gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <70063950702121714w580120d9r4119f9ff7d9f4c9d@mail.gmail.com> User-Agent: Mutt/1.4.2.2i Cc: freebsd-questions@freebsd.org Subject: Re: recovery after power outage X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Feb 2007 01:54:13 -0000 On Mon, Feb 12, 2007 at 08:14:28PM -0500, Marty Landman wrote: > On 2/12/07, Jerry McAllister wrote: > > > >On Fri, Feb 09, 2007 at 04:48:44PM -0500, Marty Landman wrote: > > > >> >>> Information from DOS bootblock is: > >> >>> The data for partition 1 is: > >> >>> sysid 165 (0xa5),(FreeBSD/NetBSD/386BSD) > >> >>> start 63, size 490223412 (239366 Meg), flag 80 (active) > >> >>> beg: cyl 0/ head 1/ sector 1; > >> >>> end: cyl 1023/ head 254/ sector 63 > >> > >> >What does bsdlabel show for it? > >> > > >> >> As root, do: bsdlabel ad1s1 > >> > >> %sudo bsdlabel ad1s1 > >> # /dev/ad1s1: > >> 8 partitions: > >> # size offset fstype [fsize bsize bps/cpg] > >> c: 490223412 0 unused 0 0 # "raw" part, > >don't > >> edit > >> % > >> > >> So where do I stand? > > > >Hmmm. Well, that looks like a slice that has not been partitioned - > >which is essentially what you have been telling us it is. That is > >not 'dangerously dedicated'. It is instead an incompletely partitioned > >and build slice. > > This HD was working fine for months until the system crashed due to a power > outage. My point is I think it had been done right to begin with but the > drive's data has been corrupted now. Since fsck isn't able to deal with it > wonder if the data is essentially gone now. > > It has type 'unused' which is what the 'c' partition should be and > >as such, should not be used. > > Are you saying I should not have set this drive up as the c partition? > Instead it should have been something like ad1s1a for example? That is true. You should not use the 'c' partition. That is documented. Too late now, but yes, ad1s1a would be better. -- next time. > I am wondering what would happen it you tried to mount /dev/ad1s1 > >without the 'c'. > > %sudo mount /dev/ad1s1 > mount: /dev/ad1s1: unknown special file or file system > %sudo mount /dev/ad1s1c > mount: /dev/ad1s1c: unknown special file or file system > % I am presuming you actually gave it a mount point in those mount commands and just didn't reproduce it here. > I don't know if fsck might work on that. You might try it (as /dev/ad1s1) > >with a '-d' flag to see what it might try without actually writing > >anything > >to the drive and potentially wrecking something. Make sure it is not > >mounted before trying the fsck. > > %sudo fsck -d /dev/ad1s1 > fsck: Could not determine filesystem type > %sudo fsck -d /dev/ad1s1c > start (null) wait fsck_unused /dev/ad1s1c > % Well, it is not finding something it needs, probably in the partition label. > Did you build a filesystem on this slice with newfs? > > I believe that's how I did it. > > If so, you can try looking for superblocks. > > How do I do that? You will have to read up on that. I pulled about some superblocks about 9 years ago, but don't remember much about that. Anyway, they point the filesystem and there are a lot of duplicates. If one is bad, it is sometimes possible to use the next one or so to get things repaired. You can read up the superblock with 'dd' just like below. You can put in a skip count in dd to skip what you don't want to read and then read up just the length you need. You will have to look that up. > If you have space for it somewhere, you could also try to dd some of > >the drive. > > dd if=/dev/ad1s1 of=some_file_on_another_disk bs=512 count=10000 > > > Ok that works, and there is data there. > > That would copy 5 MB Then you could play with that data in hex > >or with some debugger (hexdump??) that lets you muck with it a byte > >at a time in hex, ASCII, octal, etc and see what you can find. > > > ^@%s: not a directory. > ^@Not ufs > ^@format^@Invalid %s > ^@/boot.config^@%s: %s^@/boot/loader^@/boot/kernel/kernel^@ > FreeBSD/i386 boot > Default: %u:%s(%u,%c)%s > boot: ^@^H ^H^@No %s > ^@yes^@no^@Keyboard: %s > ^@slice^@label^@partition^@%c^H^@error %u lba %u > > Ok I haven't taken to picking apart the bits in this, but that's the stuff > that looked like English in the plaintext version. > > Are you saying Jerry that if fsck won't deal with this data then my only > option is to learn/pick apart the internals of the data on that disk myself? Pretty much, that's it. > I mean what else can I try? Could I - since have already saved the first 5 > MB of the data - try writing a new mbr and see if that let's fsck fix the > rest? Well, it is not an MBR that you need. That is for booting although it would not hurt to have one. But the slice table or the partition label might be clobbered. The slice table is written by fdisk and the partition label is written by bsdlabel. I don't know if you can manage to rewrite those in place without making the rest of thing inaccessible or if it would just go there and happily point to where it used to. I have never tried that. If I were to be contemplating that sort of thing, I would try it on another disk first to see what would happen. Build a disk the same way you did this one and put a few files one it. They use fdisk and bsdlabel to rewrite the slice table and label. (but don't do the newfs as that would definitely wipe things) Then see if the files are still there and readable. It wouldn't need to be a disk as big as the one your are trying to recover, just any old drive laying around that you can use to prove concept. > Pretty much over my head here, would rather not lose this 50 GB of data but > not sure what more I can do. Well, I would try the experiment mentioned above with a spare drive. If it works, then maybe that can get you going. If not, read up on superblocks. You can dd everything off to somewhere and try following pointers. That is awfully tedius, but I bet once you got past the first couple, the rest will be just fine. Then you could try patching up what got corrupted and using dd to write it all - including slice table and partition label to a drive and try to read it. If you use dd on a device rather than a file it reads or writes on a sector by sector basis rather than by the file chain so if you are lucky, you can pull stuff off, rewrite the munged spots if you can find them and then write it all out again (i'd I would use a spare drive to write to if possible) and see if it works. I would try the slice table and partitino label rewrite experiment first though. It does sort of sound like what got smoched is something in the label. Otherwise it wouldn't say 'unused' - or I don't think it would. I would expect a different error. ////jerry > > Marty > > -- > Web Installed Formmail - http://face2interface.com/formINSTal/ > Webmaster's BBS - http://bbs.face2interface.com/