From owner-freebsd-current@FreeBSD.ORG Sat Oct 2 19:08:42 2004 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 099C016A4CE for ; Sat, 2 Oct 2004 19:08:42 +0000 (GMT) Received: from beagle2.mehnert.org (beagle2.mehnert.org [212.42.235.57]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3297E43D1D for ; Sat, 2 Oct 2004 19:08:41 +0000 (GMT) (envelope-from hannes@mehnert.org) Received: from localhost (port-212-202-198-15.dynamic.qsc.de [212.202.198.15]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "Hannes Mehnert", Issuer "mehnert root CA" (verified OK)) by beagle2.mehnert.org (Postfix) with ESMTP id 312E59585D for ; Sat, 2 Oct 2004 21:08:39 +0200 (CEST) Date: Sat, 2 Oct 2004 21:08:38 +0200 From: Hannes Mehnert To: freebsd-current@freebsd.org Message-ID: <20041002190838.GA8104@mehnert.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.4.2.1i Subject: file system recovery X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 02 Oct 2004 19:08:42 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I updatet yesterday to -CURRENT (from -CURRENT from about 09/20). I use gbde, so I attached my gbde device (a partition, no md-device). After mounting it I was not able to access files. An ls /mnt/crypto/ froze the system, I had to reboot. After reboot fsck was not able to check the attached gbde device: # fsck -t ufs /dev/ad0s2f.bde ** /dev/ad0s2f.bde ** Last Mounted on /mnt/crypto ** Phase 1 - Check Blocks and Sizes fsck_ufs: cannot alloc 2728847320 bytes for inoinfo I downgraded to -CURRENT from 20040915, but it was also not able to run fsck. I also tried other superblocks (fsck -b), nothing changed, looks like something else broke. dumpfs core dumps (https://berlin.ccc.de/~hannes/dumpfs). I patched dumpfs to ignore cg 1 (cause it contains invalid data), then it core dumped at cg 2 (it had some other negative values in cg 2 nfree,..). It looks like nbfree, ndir, nifree and nffree is in the cs[] struct. Are there any tools to fix the file-system (with assumptions like nbfree can't be negative)? I tried sysutils/autopsy, but this was also not able to recover any data. It returns "Out of memory during "large" request for 536875008 bytes, total sbrk() is 271708160 bytes at /usr/ports/sysutils/autopsy/work/autopsy-1.73/autopsyfunc.pm line 2048." Also the sysutils/sleuthkit toolset also does not work. (Cannot allocate memory). dd if=/dev/ad0s2f.bde bs=1m count=20 skip=32 | strings returns data which is (was?) on the file system. Any ideas how to recover the data (apart from shell-skripts which use dd and strings)? Best Regards, Hannes Mehnert -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (FreeBSD) iD8DBQFBXvyzRcuNlziBjRwRApVuAJ9PejAVFZgcgqh4nyvVP01EYG+DGwCfWt+f 6XVOUA26dJ4sefxiy57StP8= =mzIA -----END PGP SIGNATURE-----