Fscked up partition?

PhuckFonix · 08-02-2004, 06:07 PM

Tengo uno problema, mis amigos...

I booted up to day with an error on the files systems check.

Here's a normal passing check:

Quote:

/dev/hda6: clean, 14197/786432 files, 1256384/1572850 blocks

Here is a messed up partition:

Quote:

fsck.ext3 Could this be a zero-lenght partition?
: Attempt to read block from the file system resulted in short read while trying to open /dev/hdb3
Failed to check filesystem. Do you want to repair the errors? (Y/N)
(beware, you can lose data)

Yes doesn't fix this, and not surprising niether does no.

So, I utilized my 1337 sk1llz and

vim /etc/fstab [removed /dev/hdb3 /mnt/lin4 ext defaults 1 2]
and :w! [saved[

I am on this machine now, asking what fscked up. Please help.

jailbait · 08-02-2004, 06:23 PM

"fsck.ext3 Could this be a zero-lenght partition?
: Attempt to read block from the file system resulted in short read while trying to open /dev/hdb3"

Possibly the superblock at the beginning of the file system is broken. If that is all that is broken then you might be able to repair the file system by using the redundant information in one of the other superblocks. Depending on your file system blocksize the second superblock is at 8193, 16384, or 32768. So try specifying a secondary superblock.

fsck -t ext3 -b 8193 /dev/hdb3

You might have more room to maneuver if you boot a rescue CD and run fsck from there instead of trying to repair things using the boot file system error script.

___________________________________
Be prepared. Create a LifeBoat CD.
http://users.rcn.com/srstites/LifeBo...home.page.html

Steve Stites

PhuckFonix · 08-02-2004, 07:35 PM

Code:

fsck -t ext3 -b 8193 /dev/hdb3
fsck 1.34 (25-Jul-2003)
e2fsck 1.34 (25-Jul-2003)
fsck.ext3: Bad magic number in super-block while trying to open /dev/hdb3

The superblock could not be read or does not describe a correct ext2
filesystem.  If the device is valid and it really contains an ext2
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
    e2fsck -b 8193 <device>

It seems if I keep going up the ladder, I'll have more data lost. I have System Rescue CD v 0.2.13. Should I run the same fsck command there? I'll try man fsck, but please reply here anywhoo.

jailbait · 08-02-2004, 08:01 PM

"It seems if I keep going up the ladder, I'll have more data lost."

No. By starting at a superblock other than the first you are not losing data. Whenever fsck figures things out it will repair the damaged superblock(s) and rebuild as much of the file system as possible. You are not "giving up" on the data between the first superblock and the one that fsck manages to figure out. There is redundent information in the superblocks to where it is possible to use any superblock as the "master" superblock. The question is whether you have any good superblocks and if so where are they?

" I have System Rescue CD v 0.2.13. Should I run the same fsck command there? "

Yes. I am not familiar with System Rescue CD v 0.2.13. If it automatically mounts every partition that it finds then start out by umounting the mounted partition because you should not run fsck against a mounted file system:

umount /dev/hdb3

"I'll try man fsck"

Also read man e2fsck. The command parameters are not the same. If fsck does not recognize a parameter then it just passes it on to the fsck subprogram that handles the file system type being checked.

------------------
Steve Stites

PhuckFonix · 08-02-2004, 10:04 PM

Code:

fsck -t ext3 -b 32768 /dev/hdb3
fsck 1.34 (25-Jul-2003)
e2fsck 1.34 (25-Jul-2003)
/dev/hdb3 was not cleanly unmounted, check forced.
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information

/dev/hdb3: ***** FILE SYSTEM WAS MODIFIED *****
/dev/hdb3: 995/2202112 files (8.3% non-contiguous), 1528258/2200708 blocks

Why do superblocks get damaged? Why didn't the script know this and fix the problem itself? What is a superblock? What information does it containt? The ext2 and ext3 are different? All these questions and more are welcomed to be answered while I mount my partition again, make note of this superblock command, and google these questions myself.

jailbait · 08-03-2004, 09:46 AM

"Why do superblocks get damaged?"

Probably an I/O error or perhaps gremlins in the works.

"Why didn't the script know this and fix the problem itself?"

The programmer just didn't include this feature in fsck. That would be a good project for some programmer, changing fsck to check for valid superblocks when the first is unusable.

"What information does it containt?"

It is the top control block in a chain of control blocks which describe the status of all the space in the file system.

"The ext2 and ext3 are different?"

Yes. But they are not as different from each other as most file systems. Ext3 was created by making some minor additions to ext2. So the programs that access and manipulate ext2 will also work with ext3 to some extent, but they are not 100% compatible so running ext2 programs against ext3 or vice versa is chancy.

___________________________________
Be prepared. Create a LifeBoat CD.
http://users.rcn.com/srstites/LifeBo...home.page.html

Steve Stites

PhuckFonix · 08-07-2004, 11:32 AM

I still cannot access the partition. I think I would have to copy the third superblock and put it to the first because when I startup Linux, I figure it only reads the first one(corrupt) and not the third one(working). How do I copy superblocks?

jailbait · 08-07-2004, 12:34 PM

"I still cannot access the partition. I think I would have to copy the third superblock and put it to the first because when I startup Linux, I figure it only reads the first one(corrupt) and not the third one(working). How do I copy superblocks?"

When fsck said: "/dev/hdb3: ***** FILE SYSTEM WAS MODIFIED *****" that meant that it had recreated any corrupt superblocks from the valid superblock that you pointed fsck at. So if you are having the problem again I suspect that you have a bad spot on the hard drive where the first superblock is located and the first superblock is being screwed every now and then. So assuming that a bad spot is the problem ( I am not 100% certain of that. ) then you should get the partition readable again, back up the partition to another device, and get rid of the bad spot. You can get rid of the bad spot by recreating the partition leaving a little dead space not part of any partition between hdb2 and hdb3. Or you can format hdb3 and tell mkfs to check for bad blocks. If the bad spot is an intermitent error then checking for bad blocks can be hit or miss.

Another possibility is that your partitions may overlap. If another partiton occasionally writes over the first superblock that could be the cause of your problem. Print out your partition table and check it for reasonableness.

fdisk -l /dev/hdb

"How do I copy superblocks?"

You don't copy superblocks per se. You select which superblock fsck is to use as the valid superblock and it will recreate any bad superblocks from the valid one. You have superblocks at 0, 32768, 65536, 98304, . . . to the end of the partition.

___________________________________
Be prepared. Create a LifeBoat CD.
http://users.rcn.com/srstites/LifeBo...home.page.html

Steve Stites

PhuckFonix · 08-07-2004, 02:26 PM

Code:

Disk /dev/hdb: 20.4 GB, 20490559488 bytes
16 heads, 63 sectors/track, 39703 cylinders
Units = cylinders of 1008 * 512 = 516096 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/hdb1           23708       24747      524160    5  Extended
/dev/hdb2   *       28954       39703     5418000   83  Linux
/dev/hdb3               1       17466     8802832+  83  Linux
/dev/hdb5           23708       24747      524128+  82  Linux swap

hdb3 looks fishy to me. hdb is my old harddisk I think. there are traces of an attempted Linux install here, from slack 10.0 which froze on install(BAD BLOCKS?) I have tried other distro installations and they freeze, too. I think, though, that one of those partions(prolly dear hdb3) has important files.

hda is new and is running fine, the focus, then is on hdb.

Update: I think testdisk recovered partitions that overlapped, there is a partitionon hdb that has important files, the other partitions are worthless. Can I just create a big partition on hdb and use a file recovery tool to get them out of the new partition?

jailbait · 08-07-2004, 04:40 PM

"Can I just create a big partition on hdb and use a file recovery tool to get them out of the new partition?"

No. Linux looks for superblocks at location 0 and other fixed displacements from the beginning of the partition. If you shift the partition boundaries Linux won't find anything that it recognizes as a valid file system.

"hdb3 looks fishy to me. hdb is my old harddisk I think. there are traces of an attempted Linux install here, from slack 10.0 which froze on install(BAD BLOCKS?) I have tried other distro installations and they freeze, too. I think, though, that one of those partions(prolly dear hdb3) has important files."

Also you have some unused space between 17466 and 23708 and then again between 24747 and 28954. Is 39703 the end of the hard drive or is there more empty space after 39703? I did a rough calculation and came up with about 3G unused at the end of the hard drive.

I recommend that you use fsck to try to make hdb3 readable. Then back up hdb3 on another device. Then go to the hard drive manufacturer's web site and download a low level format program for your hard drive. Low level format hdb. This will take roughly two hours. Low level format will assign a spare block at the end of the hard drive in place of any bad blocks that it finds. This will work OK as long as the number of bad blocks does not exceed the number of spare blocks. If the number of bad blocks exceeds the number of spare blocks then the drive is kaput. Low level format will completely erase the hard drive. Then partition the hard drive, format the partitions, and restore the data.

___________________________________
Be prepared. Create a LifeBoat CD.
http://users.rcn.com/srstites/LifeBo...home.page.html

Steve Stites

PhuckFonix · 08-07-2004, 05:42 PM

Before I got your reply, I testdisked and wrote a new partition table:

Code:

: p

Disk /dev/hdb: 20.4 GB, 20490559488 bytes
16 heads, 63 sectors/track, 39703 cylinders
Units = cylinders of 1008 * 512 = 516096 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/hdb1   *       28954       39703     5418000   83  Linux

There was an ext3 or ext2 file recovery program. Do you know the name of it? I can't find it yet on google. I will try to dig out the files from the new partition.

Also, what backup media do you recommend? Should I buy a tape drive? Do you have a specific one you recommend? Where should I store my tapes, and in what manner?

jailbait · 08-07-2004, 06:19 PM

"There was an ext3 or ext2 file recovery program. Do you know the name of it? I can't find it yet on google."

Sorry, I don't know.

"Also, what backup media do you recommend? Should I buy a tape drive?"

I used a tape drive as a backup device for several years. Then I switched to CD-RW. Both are fairly slow when doing backups. But when you are restoring files the CD-RW beats a tape drive by a mile every time. It is far less aggravating to restore from a CD-RW than to restore from a tape. Both tapes and CD-RW physically wear out with usage but a CD-RW lasts longer and costs less to replace than a tape.

"Should I buy a tape drive? Do you have a specific one you recommend?"
I haven't looked at tape drives in years so I don't even know what models are currently available or what the price range is.

"Where should I store my tapes, and in what manner?"

I just stored them in a plastic box, ordered by generation (I still have my last three weekly tape backups, circa 2001) . I do the same thing with my CD-RW backups.

------------------------------
Steve Stites

PhuckFonix · 08-08-2004, 04:15 PM

I see things now. My hdb is bad, I always cut of the power when my OS freezes or when a live CD freeze without unmounting the hdb. hdb is also not mounted on a bay, it's not wide enough for the 5"+ bay. It's five years old and I get

Code:

hdb: dma_intr: status=0x51 {Drive Ready Seek

errors.

I think 80 or 60 gigs are going cheap now. I want one that runs cool and quite and is durable(longevity). Do you recommend a brand harddrive? A specific model? Where can I get a "cruch" to mount that harddrive to the bay so that it's not loose at thebottom of the case?

How do I copy partitions to the new /dev/hdx?

I need it to literally copy the physical data on the partition to the new drive because if it just copies superblocks, files indexes, whatever, it will probably be empty space. I think you understand that I have deleted data that has not been overwritten in those sectors of the disc which I will try to recover with file partition recovery programs such as fatback for win32 partitions.

JZL240I-U · 08-09-2004, 05:09 AM

Depends from the type of data you are trying to rescue. So: if it's really columns and rows of numbers you can

Code:

dd if=/dev/hdb3 of=/directory/filename [on your new drive]

then open the file with an (hex)-editor and save the parts you want.

Else you can

Code:

dd if=/dev/hdb3 of=/dev/hdx

for a one to one transfer of the /dev/hdb3 data. Also

Code:

man dd

since there is also a switch which lets dd carry on even after stumbling over faulty data, but I can't remember the syntax right now.

PhuckFonix · 08-09-2004, 06:03 PM

Q: How can I recover (undelete) deleted files from my ext3 partition?
Actually, you can't! This is what one of the developers, Andreas Dilger, said about it:

In order to ensure that ext3 can safely resume an unlink after a crash, it actually zeros out the block pointers in the inode, whereas
ext2 just marks these blocks as unused in the block bitmaps and marks the inode as "deleted" and leaves the block pointers alone.

Your only hope is to "grep" for parts of your files that have been deleted and hope for the best.

Can someone interpret this for me? Fact: I have not written or mounted any partition on the harddrive for a while.

The way I understand it. When I delete a file on windows it just marks it as unused, but when I delete files on ext3 they are 0s. Thankfully, I have only created a new partition over it and have not done any file deletion commands.

I will man grep, but feel free to help me out with grep.