From owner-freebsd-questions@FreeBSD.ORG Fri Apr 3 23:27:14 2009 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 4E533106566B for ; Fri, 3 Apr 2009 23:27:14 +0000 (UTC) (envelope-from wblock@wonkity.com) Received: from wonkity.com (wonkity.com [67.158.26.137]) by mx1.freebsd.org (Postfix) with ESMTP id 097738FC0A for ; Fri, 3 Apr 2009 23:27:13 +0000 (UTC) (envelope-from wblock@wonkity.com) Received: from wonkity.com (localhost [127.0.0.1]) by wonkity.com (8.14.3/8.14.3) with ESMTP id n33NQsdV029054; Fri, 3 Apr 2009 17:26:54 -0600 (MDT) (envelope-from wblock@wonkity.com) Received: from localhost (wblock@localhost) by wonkity.com (8.14.3/8.14.3/Submit) with ESMTP id n33NQsqY029051; Fri, 3 Apr 2009 17:26:54 -0600 (MDT) (envelope-from wblock@wonkity.com) Date: Fri, 3 Apr 2009 17:26:54 -0600 (MDT) From: Warren Block To: snott In-Reply-To: <22872988.post@talk.nabble.com> Message-ID: References: <22862006.post@talk.nabble.com> <22872988.post@talk.nabble.com> User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.0.1 (wonkity.com [127.0.0.1]); Fri, 03 Apr 2009 17:26:54 -0600 (MDT) Cc: freebsd-questions@freebsd.org Subject: Re: Recovering partitions from disk image? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Apr 2009 23:27:14 -0000 On Fri, 3 Apr 2009, snott wrote: > Update: I figured out how to get scan_ffs to read a file by looking at the > program source (if it starts with / then it considers it a regular file to > read instead of a device) and got the following results which matches well > with the TestDisk output. > > $ scan_ffs -s /recovery/disk0.img > ufs1 at 1087 size 2621440 mount / time Wed Dec 31 16:00:00 1969 > ufs1 at 10486847 size 5242880 mount /var time Wed Dec 31 16:00:00 1969 > ufs1 at 31458367 size 5242880 mount /usr/home time Wed Dec 31 16:00:00 1969 > ufs1 at 54525634 size 46680873 mount /mnt time Wed Dec 31 16:00:00 1969 > > Looks about right compared to the df output I had from that host: > > Filesystem Size Used Avail Capacity Mounted on > /dev/twed0s1a 4.9G 2.8G 1.7G 62% / > /dev/twed0s1e 9.8G 5.0G 4.0G 56% /var > /dev/twed0s1f 9.8G 952M 8.1G 10% /usr/home > /dev/twed0s2e 88G 15G 65G 19% /mnt > > So, what can I do with those numbers? It doesn't look like there's any > valid MBR or disklabel on this disk image. Can I extract these filesystems > one at a time from the image and mount them somehow? Looks like scan_ffs is reporting block size. I'd take a spare computer with a blank disk and do a minimal FreeBSD install on it, setting the units to blocks in the partition screen and duplicating the values given by scan_ffs. Then connect your read-only image media and dd to each partition, using dd's skip option to skip over previous partition data. Daring users (i.e., those who are sure they won't confuse source with target) might install a blank drive in a live machine and use fdisk, bsdlabel, and dd from there. -Warren Block * Rapid City, South Dakota USA