From owner-freebsd-fs  Sun Nov  2 06:32:43 1997
Return-Path: <owner-freebsd-fs>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.7/8.8.7) id GAA22062
          for fs-outgoing; Sun, 2 Nov 1997 06:32:43 -0800 (PST)
          (envelope-from owner-freebsd-fs)
Received: from murkwood.gaffaneys.com (dialup2.gaffaneys.com [208.155.161.52])
          by hub.freebsd.org (8.8.7/8.8.7) with ESMTP id GAA22025
          for <fs@FreeBSD.ORG>; Sun, 2 Nov 1997 06:32:38 -0800 (PST)
          (envelope-from zach@gaffaneys.com)
Received: (from zach@localhost)
	by murkwood.gaffaneys.com (8.8.7/8.8.6) id IAA02898;
	Sun, 2 Nov 1997 08:32:09 -0600 (CST)
From: Zach Heilig <zach@gaffaneys.com>
Message-ID: <19971102083208.35411@gaffaneys.com>
Date: Sun, 2 Nov 1997 08:32:08 -0600
To: Gopakumar H Pillai <gopu@global.com>
Cc: fs@FreeBSD.ORG
Subject: Re: Help in disk recovery
References: <3457E1F0.AC037AFD@global.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 0.84
In-Reply-To: <3457E1F0.AC037AFD@global.com>; from Gopakumar H Pillai on Wed, Oct 29, 1997 at 05:25:04PM -0800
Sender: owner-freebsd-fs@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

On Wed, Oct 29, 1997 at 05:25:04PM -0800, Gopakumar H Pillai wrote:
> I am a sysadmin, fairly new to the job. The OS is FreeBSD 2.2.2. I had a
> disk sd0s1e of 2GB and sd1s1e of 1GB. In the process of finding out the
> device name of the tape drive I did a "tar cvf rsd0 /tmp". The amount of
> data I have written over the raw disk is about 20K. This disk has /usr.
> I need to retrieve /usr, mainly my mails in /usr/home. How should I go
> about it?

If you remember the start (exactly) of the /usr partition, you can use
disklabel to put the partition back (disklabel -e -r sd0).  You may have
to use 'fdisk' first...

After you have the partition back, you should be able to run fsck using one
of the backup superblocks.  They are usually at:
0, 32, 65568, 131104, (w/ superblocks at +65536 to the end of the partition).

example: fsck -b 131104 /dev/rsd0s1e

You may need to use 'fsdb' as well to get the disk to a state so it can be
mounted.  You will notice a few files gone, but probably not more than 10 or
so.

I accidentally did this to my boot disk when I wanted to zero out sd1...
the first 600k was overwritten before I noticed (fortunately, dd was going
very slow... at 150K/sec. that drive will usually do 2meg/sec)...

> I retrieved sd1s1e, i.e. /var and got the /var/mail.

So you should be able to figure out the size and start of the /usr partition
fairly easily.

> I cannot mount or fsck this device since it complains, improper
> superblock. I have another machine with similar partitioning, would that
> help?

> How can I make an exact image of the ruined disk on another one of
> the same hardware configuration?

> Which is a good book to know the inside out of the FreeBSD 2.2.2 File
> system?

-- 
Zach Heilig