Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 08 Mar 2001 15:19:45 +0100
From:      Rainer Hurling <rhurlin@gwdg.de>
To:        kaltorak@quake.com.au
Cc:        freebsd-stable@FREEBSD.ORG, freebsd-questions@FREEBSD.ORG
Subject:   Re: Oh no...
Message-ID:  <3AA79501.3B29C735@gwdg.de>
References:  <3AA5EAE0.C9CEF366@quake.com.au> <20010308143839.A48446@wop21.wop.wtb.tue.nl>

next in thread | previous in thread | raw e-mail | index | archive | help
"Karel J. Bosschaart" wrote:
> 
> On Wed, Mar 07, 2001 at 07:01:36PM +1100, Kal Torak wrote:
> > Hiyas...
> >
> > I kinda did a fdisk -BI on my main HDD by accident... It killed
> > all my partitions... I tried to get them back with sysinstall and
> > the live file system, but I cant mount them and stuff...
> >
> > Is there some way I can get my data back? I dont care so much about
> > the file systems.. But there are some files I would *LOVE* to get
> > back...
> >
> > Any pointers would be great...
> >
> Oops, that's a nasty situation... it remembers me to a similar thing a while
> back. A colleague screwed his combined Windows/FreeBSD setup, didn't have
> a backup and asked my assistance as he wanted to have some stuff back.
> 
> Partition tables and disklabels were gone, and as others already pointed
> out, recovering the filesystems means recovering/reconstructing these
> tables. What I did first: rip out the disk, put it in another machine
> and copied byte by byte with dd to one big 9 GB file, so I had at least
> this 'backup' before doing more damage.
> 
> As I knew approximately the sizes and locations of the partitions, I
> looked into the file, by extracting parts of it, again using dd, hoping to
> find indications for the start of a partition. I used 'strings'
> on the files, because strings are more easily to recognize for humans.
> I guess that if you have more knowledge about the ufs filesystem you
> can use more sophisticated things to find the beginning, searching for
> binary patterns. Anyway, with my limited knowledge and some luck I was able
> to find the beginning of /usr, the most important partition to be retrieved:
> After doing a dd on the /usr partitions of various FreeBSD machines I
> found a certain string pattern always on exactly the same spot (the pattern
> was "/usr" I think). So I looked for the pattern in the disk dump, and then
> reconstructed the disklabel in such a way that a dd on that partition would
> result in that pattern on that location. After a few tries I was very happy
> to notice no error message after the mount command.... everything seemed
> to be there, so I immediately backed it up in usr.tgz on another drive. As
> I did not succeed in getting / and /var back (they were possibly corrupted
> by a Windows installation) I did a newfs on them, and copied the root and
> /var from another FreeBSD machine to them. Using 'dd' and 'strings' on the
> original 9 GB dump (or on parts of it), I could retrieve some essential
> information from the filesystems that I could not recover; the password
> file and /etc/rc.conf were such things. I inserted them in the newly copied
> root and rebooted with fingers crossed... it worked. And as there appeared to
> be a complete object tree on the system (lucky, lucky), I did a
> 'make installworld', built/installed a new kernel and finally 'mergemaster'
> to ensure everything to be nicely synced again.
> 
> So after all, the FreeBSD installation was almost completely recovered;
> the package database (/var/db/pkg) was missing, but I think that's an
> acceptable loss in this case.
> 
> Well, that was roughly what I have done to recover a disk... it took me a day,
> but the successfull result gave me a good feeling :-). I know there was
> some luck involved...
> 
> The Windows partition was lost forever....
> 
> I wish you very good luck when you decide to try retrieving your data,
> 
> Karel.
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-stable" in the body of the message


Perhaps there is another way of getting your informations of sector 00
back. 

A few days ago I lost my sector 00 information by a harddisk failure
(IBM DCAS 4,3GB). Booting from another disk I got a working system with
all tools necessary to rebuild the first sector. 

I found 'gpart' in the ports collection (/usr/ports/sysutils/gpart) what
has done his job very well. It was able to scan for my partitions and
filesystems on the damaged harddisk. I got back my first primary
partition with Windows98 and my second primary partition with
FreeBSD4.2. Nothing was lost!

If the found information from 'gpart' seems plausible, you can write it
back to sector 00. But _please_ read the man page carefully before
writing anything back to disk!

Hope I could help you,

Rainer


-- 
Rainer Hurling, Ass. d. Fd.                  email: rhurlin@gwdg.de
Institut fuer Forstzoologie und Waldschutz   http://www.gwdg.de/~rhurlin
Georg-August Universitaet Goettingen         office: 0551 39-2291
Buesgenweg 3, D-37077 Goettingen, GERMANY    fax: 0551 39-2089

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3AA79501.3B29C735>