Date: Thu, 8 Mar 2001 14:38:39 +0100 From: "Karel J. Bosschaart" <karelj@wop21.wop.wtb.tue.nl> To: Kal Torak <kaltorak@quake.com.au> Cc: FreeBSD-stable <freebsd-stable@FreeBSD.ORG>, FreeBSD-questions <freebsd-questions@FreeBSD.ORG> Subject: Re: Oh no... Message-ID: <20010308143839.A48446@wop21.wop.wtb.tue.nl> In-Reply-To: <3AA5EAE0.C9CEF366@quake.com.au>; from kaltorak@quake.com.au on Wed, Mar 07, 2001 at 07:01:36PM %2B1100 References: <3AA5EAE0.C9CEF366@quake.com.au>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Mar 07, 2001 at 07:01:36PM +1100, Kal Torak wrote: > Hiyas... > > I kinda did a fdisk -BI on my main HDD by accident... It killed > all my partitions... I tried to get them back with sysinstall and > the live file system, but I cant mount them and stuff... > > Is there some way I can get my data back? I dont care so much about > the file systems.. But there are some files I would *LOVE* to get > back... > > Any pointers would be great... > Oops, that's a nasty situation... it remembers me to a similar thing a while back. A colleague screwed his combined Windows/FreeBSD setup, didn't have a backup and asked my assistance as he wanted to have some stuff back. Partition tables and disklabels were gone, and as others already pointed out, recovering the filesystems means recovering/reconstructing these tables. What I did first: rip out the disk, put it in another machine and copied byte by byte with dd to one big 9 GB file, so I had at least this 'backup' before doing more damage. As I knew approximately the sizes and locations of the partitions, I looked into the file, by extracting parts of it, again using dd, hoping to find indications for the start of a partition. I used 'strings' on the files, because strings are more easily to recognize for humans. I guess that if you have more knowledge about the ufs filesystem you can use more sophisticated things to find the beginning, searching for binary patterns. Anyway, with my limited knowledge and some luck I was able to find the beginning of /usr, the most important partition to be retrieved: After doing a dd on the /usr partitions of various FreeBSD machines I found a certain string pattern always on exactly the same spot (the pattern was "/usr" I think). So I looked for the pattern in the disk dump, and then reconstructed the disklabel in such a way that a dd on that partition would result in that pattern on that location. After a few tries I was very happy to notice no error message after the mount command.... everything seemed to be there, so I immediately backed it up in usr.tgz on another drive. As I did not succeed in getting / and /var back (they were possibly corrupted by a Windows installation) I did a newfs on them, and copied the root and /var from another FreeBSD machine to them. Using 'dd' and 'strings' on the original 9 GB dump (or on parts of it), I could retrieve some essential information from the filesystems that I could not recover; the password file and /etc/rc.conf were such things. I inserted them in the newly copied root and rebooted with fingers crossed... it worked. And as there appeared to be a complete object tree on the system (lucky, lucky), I did a 'make installworld', built/installed a new kernel and finally 'mergemaster' to ensure everything to be nicely synced again. So after all, the FreeBSD installation was almost completely recovered; the package database (/var/db/pkg) was missing, but I think that's an acceptable loss in this case. Well, that was roughly what I have done to recover a disk... it took me a day, but the successfull result gave me a good feeling :-). I know there was some luck involved... The Windows partition was lost forever.... I wish you very good luck when you decide to try retrieving your data, Karel. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010308143839.A48446>