From owner-freebsd-questions@FreeBSD.ORG Fri Apr 3 05:01:44 2009 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id E6469106564A for ; Fri, 3 Apr 2009 05:01:44 +0000 (UTC) (envelope-from bounces@nabble.com) Received: from kuber.nabble.com (kuber.nabble.com [216.139.236.158]) by mx1.freebsd.org (Postfix) with ESMTP id 8CCF28FC0A for ; Fri, 3 Apr 2009 05:01:44 +0000 (UTC) (envelope-from bounces@nabble.com) Received: from isper.nabble.com ([192.168.236.156]) by kuber.nabble.com with esmtp (Exim 4.63) (envelope-from ) id 1LpbXD-0005lg-EA for freebsd-questions@freebsd.org; Thu, 02 Apr 2009 22:01:43 -0700 Message-ID: <22862006.post@talk.nabble.com> Date: Thu, 2 Apr 2009 22:01:43 -0700 (PDT) From: snott To: freebsd-questions@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Nabble-From: skye@f4.ca Subject: Recovering partitions from disk image? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Apr 2009 05:01:45 -0000 Hello FreeBSD gurus, I recently had the pleasure of trying to recover a failed RAID1 array. It consisted of two 120GB disks in mirrored configuration. Both drives have a ton of bad sectors, so bad that the 3ware RAID card stopped recognizing that there was a mirror at all. Having no other options that I could think of, I pulled the drive with the one with the least read errors, directly connected it to ATA bus and used GNU ddrescue to make a disk image with only about 7 read errors. Neither fdisk nor bsdlabel can read the disk image. I wonder if there's some funny data at the beginning of the hard drive the 3ware card used for RAID configuration? If this is true, is there a way to search for the beginning of the real fdisk data and lop it off to make a possibly valid disk image? Here's how it was laid out before the crash: Filesystem Size Used Avail Capacity Mounted on /dev/twed0s1a 4.9G 2.8G 1.7G 62% / /dev/twed0s1e 9.8G 5.0G 4.0G 56% /var /dev/twed0s1f 9.8G 952M 8.1G 10% /usr/home /dev/twed0s2e 88G 15G 65G 19% /mnt TestDisk can find all the old partitions, but I can't figure out what if anything it can actually do with them. It only finds them if I do a "quick search" and specify "Non partitioned media" as the partition type: ----------------------------------------------------------------- Disk disk0.img - 123 GB / 115 GiB - CHS 15018 255 63 Partition Start End Size in sectors P UFS 0 15 31 652 196 7 10485760 [/] P UFS 652 196 8 1958 47 24 20971520 [/var] P UFS 1958 47 25 3263 153 41 20971520 [/usr/home] P UFS 3394 14 31 15017 14 27 186723492 [/mnt] Write isn't available because the partition table type "None" has been selected. ----------------------------------------------------------------- It doesn't look like scan_ffs works on files. Can I use the testdisk output to extract some portion of the disk image and mount it somehow? Any suggestions on how to get to the data is much appreciated. I've learned the hard way that RAID1 is no substitution for a backup plan :/ Thanks, Skye -- View this message in context: http://www.nabble.com/Recovering-partitions-from-disk-image--tp22862006p22862006.html Sent from the freebsd-questions mailing list archive at Nabble.com.