Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 08 Jun 2001 01:33:49 +0100
From:      Ian Dowse <iedowse@maths.tcd.ie>
To:        Rick@DataRecoveryLink.Com
Cc:        questions@freebsd.org
Subject:   Re: Superblock question 
Message-ID:   <200106080133.aa91564@salmon.maths.tcd.ie>
In-Reply-To: Your message of "Thu, 07 Jun 2001 14:55:13 MDT." <000201c0ef94$27d8ece0$6a00a8c0@drlreception> 

next in thread | previous in thread | raw e-mail | index | archive | help
In message <000201c0ef94$27d8ece0$6a00a8c0@drlreception>, Rick Powell writes:
>like.  I did the calculation of 512 bytes per sector and 8192 bytes per
>logical block equals 16 sectors per logical block.  I then multiply 16
>sectors by 32 blocks should equal 512 sectors should be the start of the
>backup superblock.  I can't see anything at this location that looks like
>data.  I am doing this on a working freebsd drive so I can find the first
>few charactors of the superblock and then do a search for those on the bad
>drive.  Am I doing this correctly?

The first backup superblock usually begins at sector 32 on the
partition (i.e.  32 * 512 bytes from the start of the partition).
This is actually right after the master superblock, which begins
at sector 16. There is one backup superblock in each cylinder group,
and in the first cylinder group it begins in the first usable block,
so it is easy to find (filesystems with a >16k fragment size are
probably different because the first usable block is not at sector
32).

Locating later superblocks is more tricky, because you really need
to know many superblock paramaters to know where to look. It's
probably easier to just search for the "54 19 01 00" magic number
at offset 0x55c in each 8k block on the disk. The actual byte offset
from the start of the partition of the superblock in cylinder group
N is given by

  (fs_fpg * N + fs_cgoffset * (N & ~fs_cgmask) + fs_sblkno) * fs_fsize

where all the fs_* values are stored in the superblock! I think
for this reason, it used to be recommended that you write down some
of the block numbers printed by newfs when a filesystem is created,
though I doubt too many people do that now.

Ian

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi? <200106080133.aa91564>