From owner-freebsd-questions@FreeBSD.ORG Fri Jan 27 21:36:46 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 43A4616A420 for ; Fri, 27 Jan 2006 21:36:46 +0000 (GMT) (envelope-from pauls@utdallas.edu) Received: from smtp1.utdallas.edu (smtp1.utdallas.edu [129.110.10.12]) by mx1.FreeBSD.org (Postfix) with ESMTP id F144843D46 for ; Fri, 27 Jan 2006 21:36:45 +0000 (GMT) (envelope-from pauls@utdallas.edu) Received: from utd59514.utdallas.edu (utd59514.utdallas.edu [129.110.3.28]) by smtp1.utdallas.edu (Postfix) with ESMTP id 78A8D388C82 for ; Fri, 27 Jan 2006 15:36:45 -0600 (CST) Date: Fri, 27 Jan 2006 15:36:45 -0600 From: Paul Schmehl To: freebsd-questions@freebsd.org Message-ID: X-Mailer: Mulberry/3.1.6 (Linux/x86) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Subject: FreeBSD drops to single user mode X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 27 Jan 2006 21:36:46 -0000 Recently I experienced something that surprised me. I have a workstation with two SATA drives. The second drive is data only and is mounted r/w when the OS boots. We had a user whose (Windows) computer crashed and they wanted to know if we could recover the data. I said I'd see, and I unplugged the second drive (ad5 on FreeBSD, drive1 on Windows) and plugged in the suspect drive, fully expecting to mount it and copy files over. But, when FreeBSD booted, it failed to read ad5 and then dropped to single user mode. I logged in, mounted all my partitions (mount -a) and then tried to mount the suspect drive (mount -t ntfs /dev/ad5s2 /mnt/windows). FreeBSD was unable to mount the drive. I've since made a bit for bit copy of the drive using a forensics program and looked at the drive, and it is definitely FUBAR. My question is, why did FBSD drop to single user mode instead of completely the boot process? Here's my fstab, if that illuminates anything: # Device Mountpoint FStype Options Dump Pass# /dev/ad4s2b none swap sw 0 0 /dev/ad4s2a / ufs rw 1 1 /dev/ad4s2d /tmp ufs rw 2 2 /dev/ad4s2f /usr ufs rw 2 2 /dev/ad4s2e /var ufs rw 2 2 /dev/ad5s1d /files ufs rw 2 2 /dev/acd0 /cdrom cd9660 ro,noauto 0 0 /dev/acd1 /cdrom1 cd9660 ro,noauto 0 0 linprocfs /compat/linux/proc linprocfs rw 0 0 Paul Schmehl (pauls@utdallas.edu) Adjunct Information Security Officer University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu/ir/security/