From owner-freebsd-questions@FreeBSD.ORG Mon May 12 14:52:21 2003 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 32D1D37B401 for ; Mon, 12 May 2003 14:52:21 -0700 (PDT) Received: from dynamic.hydro.washington.edu (dynamic.hydro.washington.edu [128.95.246.166]) by mx1.FreeBSD.org (Postfix) with ESMTP id 96F9343FAF for ; Mon, 12 May 2003 14:52:20 -0700 (PDT) (envelope-from penglish@hydro.washington.edu) Received: from dynamic.hydro.washington.edu (localhost [127.0.0.1]) h4CLqCTP047495; Mon, 12 May 2003 14:52:12 -0700 (PDT) (envelope-from penglish@hydro.washington.edu) Received: from localhost (penglish@localhost)h4CLqCnO047492; Mon, 12 May 2003 14:52:12 -0700 (PDT) (envelope-from penglish@hydro.washington.edu) X-Authentication-Warning: dynamic.hydro.washington.edu: penglish owned process doing -bs Date: Mon, 12 May 2003 14:52:12 -0700 (PDT) From: Paul English To: Chuck Swiger In-Reply-To: <3EBD4405.8060406@mac.com> Message-ID: <20030512142857.Y47130-100000@dynamic.hydro.washington.edu> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII cc: freebsd-questions@freebsd.org Subject: Re: fsck salvaging directory structure X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 May 2003 21:52:21 -0000 On Sat, 10 May 2003, Chuck Swiger wrote: > Paul English wrote: > [ ... ] > > It wants to have fsck run - if I do that with fsck -y it will > > clean the filesystem, and mount, but *everything* (all 15GB) is in > > lost+found. > > fsck should be able to salvage some of the existing directory structure > under /lost+found; are you getting a single directory full of > inode-#-named files without any subdirectories? I should have been more accurate - there are subdirectories. What I get are 145 inode-#-named files with subdirectories under some of them. > > If I just restore the superblock with fsck, and don't do > > anything else, then I can mount the filesystem readonly, but then when I > > mount it there is nothing there: > > > > #ls /mnt > > ls: /mnt: Bad file descriptor > > What happened to the original disk? This sounds like the / directory > got wiped, along with the first superblock...was the disk partially erased? The original disk had a head crash. I sent it to a data recovery company who recovered "all but 2% of the data" and sent me back a new disk with an image of the old one on it. All this is in trying to mount the new disk. Actaully I imaged it onto yet another disk so that I wouldn't loose what they sent me, but it was the same when I tried to mount what they sent me. > > What else can I try? Pulling 15GB of data from lost+found is pretty > > impractical. > > What are you trying to accomplish? What I'd like is to restore the filesystem just as it was, but more simply the user who owns the data needs to have access to his data in a usable way. At the moment he has to sift through 145 unlinked files which is pretty bad. > What you might want to do depends on whether you want to simply identify > your files from OS files (timestamps, if still meaningful could help > here), how important recovering the directory structure is, etc. In this case, it is a separate partition from all the OS files, which I'm not even bothering with, so that narrows down the problem some. > If you knew that the first XXX MB of the disk had been wiped, you might > try installing the same version of FreeBSD you were running to a new > filesystem of the same size and layout-- be sure to specify a 8K/1K > block/frag size versus 16K/2K if that's what you had. And then copy > that chunk of data over the zero'd portion of your recovered data, and > see whether that helps. > > Or you could then perform an md5 hash of every file found on a clean > install, and md5 all of the recovered files under /lost+found, and only > pay attention to recovered files which don't have a checksum that matches. I have to admit that I'm not clear how the first one would help, but you didn't know that I'd already managed to copy this to a disk and get it recognized as a valid partition. The second one is definitely good for filtering out the OS files, but fortunatley that part I don't have to worry about. > PS: Given the state of employment in the tech industry, you might find > that offering, say, a 6-month subscription to a "beer of the month club" > to the person who helps you out the most would have astonishing results. Sounds like a plan - it isn't even that much compared to what I'm dropping on the data recovery company (although they are going to refund me if they can't do any better than this). I'll be a little more specific than "the most help" though. :-) Thanks to you - so far you have helped me narrow down and specify my question a great deal! Paul