From owner-freebsd-hackers@FreeBSD.ORG Wed Jun 14 07:20:02 2006 Return-Path: X-Original-To: freebsd-hackers@freebsd.org Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4CB3816A41A for ; Wed, 14 Jun 2006 07:20:02 +0000 (UTC) (envelope-from Alexander@Leidinger.net) Received: from www.ebusiness-leidinger.de (jojo.ms-net.de [84.16.236.246]) by mx1.FreeBSD.org (Postfix) with ESMTP id A17EC43D45 for ; Wed, 14 Jun 2006 07:20:00 +0000 (GMT) (envelope-from Alexander@Leidinger.net) Received: from Andro-Beta.Leidinger.net (p54A5DA8D.dip.t-dialin.net [84.165.218.141]) (authenticated bits=0) by www.ebusiness-leidinger.de (8.13.4/8.13.4) with ESMTP id k5E7GEcj074402; Wed, 14 Jun 2006 09:16:14 +0200 (CEST) (envelope-from Alexander@Leidinger.net) Received: from localhost (localhost [127.0.0.1]) by Andro-Beta.Leidinger.net (8.13.4/8.13.3) with ESMTP id k5E7JuUk009016; Wed, 14 Jun 2006 09:19:56 +0200 (CEST) (envelope-from Alexander@Leidinger.net) Received: from pslux.cec.eu.int (pslux.cec.eu.int [158.169.9.14]) by webmail.leidinger.net (Horde MIME library) with HTTP; Wed, 14 Jun 2006 09:19:55 +0200 Message-ID: <20060614091955.16e3e61mo4gcw4sw@netchild.homeip.net> X-Priority: 3 (Normal) Date: Wed, 14 Jun 2006 09:19:55 +0200 From: Alexander Leidinger To: Eric Anderson References: <61325.10.20.200.100.1150219994.squirrel@10.20.200.100> <20060613225316.53d939a3@Magellan.Leidinger.net> <54950.10.20.200.100.1150232553.squirrel@10.20.200.100> In-Reply-To: <54950.10.20.200.100.1150232553.squirrel@10.20.200.100> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; DelSp="Yes"; format="flowed" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable User-Agent: Internet Messaging Program (IMP) H3 (4.1) / FreeBSD-4.11 X-Virus-Scanned: by amavisd-new X-Mailman-Approved-At: Wed, 14 Jun 2006 11:26:12 +0000 Cc: freebsd-hackers@freebsd.org Subject: Re: fdisk partition / disklabel recovery (help!) X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Jun 2006 07:20:02 -0000 Quoting Eric Anderson (from Tue, 13 Jun 2006 =20 16:02:33 -0500 (CDT)): > Alexander Leidinger said: >> Quoting "Eric Anderson" (Tue, 13 Jun 2006 12:33:1= 4 >> -0500 (CDT)): >> >>> >From the subject, you probably already know my dilemma. After booting >>> a >>> linux livecd (I'll refrain from naming the distro), my laptop no longer >>> has any partitions. Now, the drive was not newfs'ed with any other OS, >>> so >>> I believe only the boot loader and partitioning are messed up. I see an >>> ffsrecov tool, that could probably help me, but I want to make sure I >>> don't make any bad decisions here. >>> >>> So, my partitioning was something like: >>> ad0 >>> ad0s1 DOS >>> ad0s2 ?? >>> ad0s3 ?? >>> ad0s4 Linux root / swap >> >> For this particular reason I always print out the layout. Got hit once, >> wrote a program to recover (only understands ufs1 disklabels, and >> stopped to work after a particular 4.x... I assume it's because of a >> blocksize/fragsize change introduced then), learned my lesson. > > I'll probably look into writing such a tool, since this is very painful. := ( You can have a look at =20 http://www.leidinger.net/FreeBSD/ffsrescue.tar.gz to get an idea (I =20 think some offsets are wrong now for UFS1, and UFS2-labels aren't =20 searched) what to do. > Printing is a good idea. :) > > >>> FreeBSD was on either ad0s2 or ad0s3, I can't recall which, but I >>> believe >>> it was ad0s3. I had 3 partitions (/, /alt, /home) and a swap. >>> >>> I'm running the ffsrecov tool now, but it appears to be very slow >>> chugging >>> through the disk. >> >> There are ways to speed such a search up. I assume my own tool tries to >> be too smart (or it's not smart enough, at least it uses wrong >> invariants) for the disklabels. And it only prints assumptions about >> the start of a FreeBSD slice, not about other slice types. > > Is there a good way to identify the bsdlabel, or other partitioning > information from a hexdumped output? You have to look at the superblock magic number at specific offsets. =20 Have a look at the above mentioned code to see what to do for UFS1. It =20 should give you a hint what you want to search for regarding UFS2. Regarding the superblocks: if you remember the blocksize/fragsize you =20 used, you can newfs a md on another system and have a look at which =20 offsets superblocks are generated. For UFS1 the first one is in block =20 16, the second one in block 32. So if you find two superblocks with a =20 distance of 16 blocks, the start of a partition is probably 16 blocks =20 before the first superblock. If you know which partition belongs to =20 which slice (AFAIR "last mounted on" is available in the superblock), =20 you should be able to find the right offsets for the slices. I don't =20 know the numbers for UFS2 out of my head. >>> Is there any additional ways I can find the partitioning scheme, or find >>> the bsdlabel's on the disk? Does anyone know of a command line >>> (dd+some >> >> Try to remember them. If you know how large the partitions have been, >> you just have to write the MBR and everything should work. If nothing >> works, you remembered wrong. > > I have some general guesses as to the sizes. Do you know if any of that > data would be in a dmesg,sysctl,etc type output? I have much of that > logged to an external site I can look at for the details.. Maybe in some geom related output, but I'm not sure. >>> tools/perl/etc) way to find the bsdlabels? >>> >>> Once the bsdlabels are found, then what? >>> >>> Also - if I rewrite the bsdlabel exactly as it was before, I should be >>> in >>> business, correct? >> >> The bsdlabels are still there I assume, it sounds just like your MBR >> got hosed. > > fdisk reports nothing, so I'm sure I just need to put the fdisk > partitioning back. Problem is, I don't know the offsets. I didn't knowed them either. But I remembered the size of the first =20 partition, so I was able to recover at least the first 2 partitions =20 out of my head at that time. Bye, Alexander. --=20 Selling GoodYear Eagle F1 235/40ZR18, 2x 4mm + 2x 5mm, ~150 EUR you have to pick it up between Germany/Saarland and Luxembourg/Capellen http://www.Leidinger.net Alexander @ Leidinger.net: PGP ID =3D B0063FE7 http://www.FreeBSD.org netchild @ FreeBSD.org : PGP ID =3D 72077137