From owner-freebsd-fs@FreeBSD.ORG Sun Jan 20 19:12:47 2008 Return-Path: Delivered-To: freebsd-fs@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id A017216A46D for ; Sun, 20 Jan 2008 19:12:47 +0000 (UTC) (envelope-from matt@gsicomp.on.ca) Received: from daisy2.compar.com (mail1.compar.com [216.208.38.140]) by mx1.freebsd.org (Postfix) with ESMTP id 788F013C459 for ; Sun, 20 Jan 2008 19:12:47 +0000 (UTC) (envelope-from matt@gsicomp.on.ca) Received: from localhost (localhost.compar.com [127.0.0.1]) by daisy2.compar.com (Postfix) with ESMTP id E689D13C418 for ; Sun, 20 Jan 2008 13:47:47 -0500 (EST) X-Virus-Scanned: amavisd-new at compar.com Received: from unknown by localhost (amavisd-new, unix socket) id IGYThKIMnIls for ; Sun, 20 Jan 2008 13:47:45 -0500 (EST) Received: from hermes (CPE00062566c7bb-CM001ac3584898.cpe.net.cable.rogers.com [99.236.43.116]) by daisy2.compar.com (Postfix) with SMTP id 5404313C40A for ; Sun, 20 Jan 2008 13:47:45 -0500 (EST) Message-ID: <000801c85b94$f3a58ea0$1200a8c0@hermes> From: "Matt Emmerton" To: Date: Sun, 20 Jan 2008 13:47:47 -0500 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_0005_01C85B6B.0A881D60" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3138 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 Subject: Looking for help to reconstruct a corrupted UFS2 filesystem X-BeenThere: freebsd-fs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Filesystems List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 20 Jan 2008 19:12:47 -0000 This is a multi-part message in MIME format. ------=_NextPart_000_0005_01C85B6B.0A881D60 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-Transfer-Encoding: 7bit Hi folks, Before anyone points out the obvious, yes, I did take backups. For reasons I won't get into here, the backup filesystem got symlinked to a location on the source drive (mere hours before the drive crapped out), which rendered my backups useless. The drive containing the corrupted filesystem is detected as ad1. This drive has two *different* partition tables on it -- /dev/ad1 shows a NTFS filesystem using the whole disk, and /dev/ad1s1 shows a FreeBSD filesystem using the whole disk. I mistakenly thought this was a disk that I had brought over from a Windows machine and proceeded to boot Windows and "repaired" the NTFS filesystem. Oops. After that failed, I realized that the disk really contained a FreeBSD filesystem on /dev/ad1s1. Attempts to reconstruct this have failed miserably. Using newfs -N, I located alternate superblocks. The majority of the superblocks are identical, with a couple being corrupted or all-zeros (including the primary superblock at 160). Using dd I copied a "good" superblock over all of the "bad" superblocks, and now all superblocks contain the same information. Now, using fsck_ufs -b /dev/ad1s1, it churns away, and eventually brings up some garbage data and fails attempting to allocate 4GB of memory. (See attached file - fsck.out). What are my options at this point? Since all the superblocks are identical, fsck always behaves the same. I suspect that one of the key blocks that the superblock points to is corrupted. Is any of this data replicated on disk? Can I troll the disk looking for intermediate blocks and easily chain together portions of directory trees? Regards, -- Matt Emmerton ------=_NextPart_000_0005_01C85B6B.0A881D60 Content-Type: application/octet-stream; name="fsck.out" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="fsck.out" Alternate super block location: 15430592=0A= ** /dev/ad1s1=0A= ** Last Mounted on =0A= ** Phase 1 - Check Blocks and Sizes=0A= -1 BAD I=3D424769=0A= 1 DUP I=3D424769=0A= 2 DUP I=3D424769=0A= 3 DUP I=3D424769=0A= 4 DUP I=3D424769=0A= 5 DUP I=3D424769=0A= 6 DUP I=3D424769=0A= -1 BAD I=3D424769=0A= 1 DUP I=3D424769=0A= 2 DUP I=3D424769=0A= 3 DUP I=3D424769=0A= 4 DUP I=3D424769=0A= 5 DUP I=3D424769=0A= EXCESSIVE DUP BLKS I=3D424769=0A= CONTINUE? [yn] =0A= INCORRECT BLOCK COUNT I=3D424769 (2172864 should be 1246296)=0A= CORRECT? [yn] fsck_ufs: cannot alloc 4294967292 bytes for inoinfo=0A= =0A= ------=_NextPart_000_0005_01C85B6B.0A881D60--