Date: Thu, 08 Mar 2001 15:19:45 +0100 From: Rainer Hurling <rhurlin@gwdg.de> To: kaltorak@quake.com.au Cc: freebsd-stable@FREEBSD.ORG, freebsd-questions@FREEBSD.ORG Subject: Re: Oh no... Message-ID: <3AA79501.3B29C735@gwdg.de> References: <3AA5EAE0.C9CEF366@quake.com.au> <20010308143839.A48446@wop21.wop.wtb.tue.nl>
next in thread | previous in thread | raw e-mail | index | archive | help
"Karel J. Bosschaart" wrote: > > On Wed, Mar 07, 2001 at 07:01:36PM +1100, Kal Torak wrote: > > Hiyas... > > > > I kinda did a fdisk -BI on my main HDD by accident... It killed > > all my partitions... I tried to get them back with sysinstall and > > the live file system, but I cant mount them and stuff... > > > > Is there some way I can get my data back? I dont care so much about > > the file systems.. But there are some files I would *LOVE* to get > > back... > > > > Any pointers would be great... > > > Oops, that's a nasty situation... it remembers me to a similar thing a while > back. A colleague screwed his combined Windows/FreeBSD setup, didn't have > a backup and asked my assistance as he wanted to have some stuff back. > > Partition tables and disklabels were gone, and as others already pointed > out, recovering the filesystems means recovering/reconstructing these > tables. What I did first: rip out the disk, put it in another machine > and copied byte by byte with dd to one big 9 GB file, so I had at least > this 'backup' before doing more damage. > > As I knew approximately the sizes and locations of the partitions, I > looked into the file, by extracting parts of it, again using dd, hoping to > find indications for the start of a partition. I used 'strings' > on the files, because strings are more easily to recognize for humans. > I guess that if you have more knowledge about the ufs filesystem you > can use more sophisticated things to find the beginning, searching for > binary patterns. Anyway, with my limited knowledge and some luck I was able > to find the beginning of /usr, the most important partition to be retrieved: > After doing a dd on the /usr partitions of various FreeBSD machines I > found a certain string pattern always on exactly the same spot (the pattern > was "/usr" I think). So I looked for the pattern in the disk dump, and then > reconstructed the disklabel in such a way that a dd on that partition would > result in that pattern on that location. After a few tries I was very happy > to notice no error message after the mount command.... everything seemed > to be there, so I immediately backed it up in usr.tgz on another drive. As > I did not succeed in getting / and /var back (they were possibly corrupted > by a Windows installation) I did a newfs on them, and copied the root and > /var from another FreeBSD machine to them. Using 'dd' and 'strings' on the > original 9 GB dump (or on parts of it), I could retrieve some essential > information from the filesystems that I could not recover; the password > file and /etc/rc.conf were such things. I inserted them in the newly copied > root and rebooted with fingers crossed... it worked. And as there appeared to > be a complete object tree on the system (lucky, lucky), I did a > 'make installworld', built/installed a new kernel and finally 'mergemaster' > to ensure everything to be nicely synced again. > > So after all, the FreeBSD installation was almost completely recovered; > the package database (/var/db/pkg) was missing, but I think that's an > acceptable loss in this case. > > Well, that was roughly what I have done to recover a disk... it took me a day, > but the successfull result gave me a good feeling :-). I know there was > some luck involved... > > The Windows partition was lost forever.... > > I wish you very good luck when you decide to try retrieving your data, > > Karel. > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-stable" in the body of the message Perhaps there is another way of getting your informations of sector 00 back. A few days ago I lost my sector 00 information by a harddisk failure (IBM DCAS 4,3GB). Booting from another disk I got a working system with all tools necessary to rebuild the first sector. I found 'gpart' in the ports collection (/usr/ports/sysutils/gpart) what has done his job very well. It was able to scan for my partitions and filesystems on the damaged harddisk. I got back my first primary partition with Windows98 and my second primary partition with FreeBSD4.2. Nothing was lost! If the found information from 'gpart' seems plausible, you can write it back to sector 00. But _please_ read the man page carefully before writing anything back to disk! Hope I could help you, Rainer -- Rainer Hurling, Ass. d. Fd. email: rhurlin@gwdg.de Institut fuer Forstzoologie und Waldschutz http://www.gwdg.de/~rhurlin Georg-August Universitaet Goettingen office: 0551 39-2291 Buesgenweg 3, D-37077 Goettingen, GERMANY fax: 0551 39-2089 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3AA79501.3B29C735>