Running Red Hat 7.3 on an HP pavilion 7935 (1 year old). It is a normal/typical install and on the internet, running apache. I've been keeping up on the security patches. Also, I recently installed samba so I could temporarily save off some data from a windows machine while I reformatted it. Unfortunately, it seems that the HP's HD has crashed. It will boot up until it goes to mount some part of the FS and wants to do a fsck, but fails a read and the kernel panics. I used Tom's rtbt floppy to run e2fsck and to try to mount the partitions. Of the 7 partitions, only the first one (the boot one) passes the e2fsck and mount test. The rest fail on at least the e2fsck with a bad read of a sector and block (even if I provide alternate superblock locations). The bad blocks are consistently reported, though they are different ones for each partition.

Also, it seems that the partition table is messed up:

device boot start end blocks ID
/dev/hda1 * 1 7 52888+ 83
/dev/hda2 8 2912 21961800 83
/dev/hda3 2913 5182 17161200 83
/dev/hda4 5183 5295 854280 f
/dev/hda5 5183 5234 393088+ 83
/dev/hda6 5235 5269 264568+ 83
/dev/hda7 5270 5295 196528+ 82

Notice how partitions 4, 5, and 6 seem to overlap? Also note that partition 4 is set as a WIN95 Ext'd (LBA) partition. I never set it that way. I didn't save of the original partition table (I know... I wish I knew to do that before).

Can I dd the data from the bad drive to a new drive? I don't know how that works, especially if the partition table is bad? I tried to run dumpe2fs and it fails reading the drive. I have another HD that I could install and move data, but I don't know how I can if I can't mount the partitions.

Basically, I'm looking for advice on how I can recover the data off this drive and to see if the drive is bad.

Thanks,
Bob

Can you post the e2fsck command and error messages?

The 4,5,6,7 partitions should overlap, partition 4 is an extended
partition that just houses the other partitions. You can't have
more than 4 partitions on your drive (still!) without using extended
partitions, this has to have been set up in the past, and is not an
error in the partition table. Unfortunately, the linux disk/filesystem
community is still using this archaic partitioning.
The partition table (from here) looks fine to me. Post the
commands and their error messages. . .

Yeah, post your error messages.

Undelete HOWTO's:
Recovering a Lost Partition Table,
Linux Partition HOWTO,
How to recover lost partitions,
Linux Ext2fs Undeletion mini-HOWTO,
Linux Partition Rescue mini-HOWTO.

Rescue tools for partition table/ext2fs:
Gpart,
Testdisk,
Parted,
Recover (app + info),
R-Linux (never tried this one),
Unrm (never tried this one),
TCT, The Coroners Toolkit* ,
tomsrtbt.
Also mc (the Midnight Commander) can undelete stuff.
* Don't use unless you're desperate w/o options left. Don't use until you have some experience with this as it's used in forensics, is a tool set and not a GUI click-n-go tool and damn slow. Make sure you are willing to make a serious investment (your time) and be prepared to still not get usefull stuff returned...

Partition imaging:
Partimage.
* For more rescue tools check Freshmeat.net, metalab.unc.edu or other depots for a /Linux/system/recovery/ dir.

I don't think this is a "partition" problem. When I did this:

e2fsck -nv /dev/hda2 > file 2>&1

I get this output:

*** hda2
e2fsck 1.27 (8-Mar-2002)
Pass 1: Checking inodes, blocks, and sizes
Error reading block 65541 (Attempt to read block from filesystem resulted in short read) while doing inode scan. Ignore error? no

Error while scanning inodes (32704): Can't read next inode
***

(This is only stdout. I can't seem to get stderr to show up in the file?)

Likewise other errors for other partitions:

*** hda3
e2fsck 1.27 (8-Mar-2002)
e2fsck: Attempt to read block from filesystem resulted in short read while checking ext3 journal for /usr

*** hda4
e2fsck 1.27 (8-Mar-2002)
e2fsck: Attempt to read block from filesystem resulted in short read while trying to open /dev/hda4
Could this be a zero-length partition?

*** hda5
e2fsck 1.27 (8-Mar-2002)
/: Attempt to read block from filesystem resulted in short read while reading block 275
/: Attempt to read block from filesystem resulted in short read reading journal superblock
e2fsck: Attempt to read block from filesystem resulted in short read while checking ext3 journal for /

Any ideas?
Bob

Have you tried e2fsck -py /dev/hdax? This will attempt to fix any
errors, and assume an answer of "yes" to any questions. It's not
necessarily what you want, but you may have to answer "y" to a
lot of inode errors.
hda3 and hda5 both look like there are errors on the journal (at
least, there may be more elsewhere), have you tried mounting
them as ext2? mount /dev/hda3 /usr -t ext2

I will certainly try that, however, the error messages I'm getting are indicative of a more serious problem. I wish I could find a way to get stderr in to a file, so I could post them here. On several of the runs, e2fsck has a segmentation fault. That's not a confidence booster (for my HD *or* e2fsck).

Bob

man bash for the redirection syntax ( search for redirection)

You could also try this:
This'll start up a log of everthing that goes to the terminal, so if
stderr is sent to the screen, it'll show up there. It'll create a file
called "typescript".