From owner-freebsd-questions@FreeBSD.ORG Sat Mar 29 23:13:26 2014 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 95FA85E9 for ; Sat, 29 Mar 2014 23:13:26 +0000 (UTC) Received: from mail-pd0-x22e.google.com (mail-pd0-x22e.google.com [IPv6:2607:f8b0:400e:c02::22e]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 6CEF07B1 for ; Sat, 29 Mar 2014 23:13:26 +0000 (UTC) Received: by mail-pd0-f174.google.com with SMTP id y13so6385946pdi.33 for ; Sat, 29 Mar 2014 16:13:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:content-type:content-transfer-encoding:subject:message-id:date :to:mime-version; bh=euZUfLeG03KCco3D9EFqRgSaXuhsFxOgFuGAQxIkqpI=; b=AgwwJatWPyPRJr0FgEv9+fjJPjiT1c06QOQL1yVlMTvR6TIJvSWDuyE3QKfzCm3Pom WKyMH6O59Y42IQ8s6aJD4xv0ZSmnm7RexISt58Jzt9tsPRTwZuWO24s3WODxxUyy8Md8 1xCaRgowmi5V0NvHAjrl/fJJd5/HKC6Zp1B8231BQeFCfM3Cxa6dlDDyE6EBvRhDxc6i Kq6L2+46ZUOM1dm6HJSVatMP3+fe4KDAntpACAtocgnyWtofDJP3wKF4pZHo5G0lankr 96I+gRvI0Z6nXJTw4VykckmO4w5MQuwD1XNrtNh+wGMVGz5En9J0pIVMpwkWZjiYLngp daBQ== X-Received: by 10.68.196.137 with SMTP id im9mr16238462pbc.105.1396134806107; Sat, 29 Mar 2014 16:13:26 -0700 (PDT) Received: from ?IPv6:2001:470:b:839:3d1b:1d3f:9876:131? ([2001:470:b:839:3d1b:1d3f:9876:131]) by mx.google.com with ESMTPSA id tf10sm33723415pbc.70.2014.03.29.16.13.25 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Sat, 29 Mar 2014 16:13:25 -0700 (PDT) From: Paul Beard Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Subject: hard drive failure: file recovery forensics Message-Id: <135FEEC0-894A-466F-B167-580479403E8C@gmail.com> Date: Sat, 29 Mar 2014 16:13:20 -0700 To: freebsd-questions@freebsd.org Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\)) X-Mailer: Apple Mail (2.1874) X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 29 Mar 2014 23:13:26 -0000 I have a disk I assume is bad, as smartctl tells me it is. The system it = was the root drive for crashed last night and I don=92t have any = evidence it was the drive but I=92m working with that assumption.=20 Smartd is logging these:=20 Mar 28 03:04:13 shuttle smartd[2086]: Device: /dev/ad2, 1 Currently = unreadable (pending) sectors Smartctl reveals this:=20 40 51 00 ee 6a d1 e1 Error: UNC at LBA =3D 0x01d16aee =3D 30501614 though no other test (the bad_blocks_scan script, for example) will find = anything wrong. recoverdisk seems to be able to read that block just = fine as I used it to clone the drive to a backup to boot from.=20 What I have been looking for is someway to find whatever file is on the = part of the disk so I can find out what I am going to be missing and to = verify that smartd knows what it=92s talking about.=20 I have read many HOWTOs on locating that block and from there, getting = the inode and the file. But none of them get me very far. fsdb doesn=92t = seem to like what I tell it.=20 bsdlabel gives me this:=20 # /dev/ad2s1: 8 partitions: # size offset fstype [fsize bsize bps/cpg] a: 1048576 0 4.2BSD 0 0 0 b: 4126336 1048576 swap =20 c: 976773105 0 unused 0 0 # "raw" part, = don't edit d: 10485760 5174912 4.2BSD 0 0 0 e: 4194304 15660672 4.2BSD 0 0 0 f: 956918129 19854976 4.2BSD 0 0 0 =46rom there I take the offset of the slice and the partition to get the = block relative to the start of the partition: echo "(30501614 - (19854976 - 63))" | bc=20 10646701 But then I seem to be stuck.=20 fsdb -r /dev/ad2s1f [=85] fsdb (inum: 2)> findblk 10646701 [time passes]=20 fsdb (inum: 2)>=20 Is there an extra step I need to take?=20=