LinuxQuestions.org
Register a domain and help support LQ
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Hardware
User Name
Password
Linux - Hardware This forum is for Hardware issues.
Having trouble installing a piece of hardware? Want to know if that peripheral is compatible with Linux?

Notices

Reply
 
Search this Thread
Old 03-27-2013, 04:35 PM   #1
ccar_support
Member
 
Registered: Jan 2007
Posts: 34

Rep: Reputation: 1
Drive recovery?


Not sure what the user did but I've got a 2TB drive that is not playing nice.

Western Digital WD2001FASS 2TB drive
was formatted with a single ext3 partition
When I run off System Rescue CD x86 with the drive connected, fdisk shows the partition still there but I cannot do anything else.

e2fsck results in:
---------------
fsck.ext2: Superblock invalid, trying backup blocks
fsck.ext2: Bad magic number in super-block while trying to open /dev/sda

Superblock could not be read or does not describe a correct ext2 filesystem.
---------------

I also ran mke2fs -n on it and it provided a long list of superblocks available but when I run e2fsck -b with the block specified, it still says "Superblock invalid".

Is there any hope of recovering the data on this drive or is this a lost cause?
 
Old 03-27-2013, 09:25 PM   #2
haertig
Senior Member
 
Registered: Nov 2004
Distribution: Debian, Ubuntu, LinuxMint, Slackware, SysrescueCD
Posts: 2,022

Rep: Reputation: 309Reputation: 309Reputation: 309Reputation: 309
How important is the data on the disk? Your best chances of recovery without further damage to the disk are to first do a bit-by-bit copy of it to a second drive. Then work on the copy, preserving the original in it's current shape in case you need to go back and start over. Buying another 2Tb disk may cost more money than you're willing to spend to recover this data.

You said the disk was formatted as a single ext3 partition. I assume the user told you this? The same user that somehow screwed up the data without knowing what happened? I would take what they say with a grain of salt - definitely consider the experience level, and honesty, of your user. Did they possibly change the partitions and then come to you for help without mentioning the "embarassing" stuff they did? I've seen it happen.

On the copy disk, I would first try running "testdisk" to see what it comes up with for previous partitions. You can also use "photorec" (it's not just for photos) to recover files from a partitionless disk. If you run photorec, you will need a place for it to store the recovered files. So that means ANOTHER hard disk. So this could get expensive if you don't have all those spare 2Tb hard disks laying around. Is the data worth it?
 
Old 03-27-2013, 10:12 PM   #3
manu-tm
Member
 
Registered: May 2008
Location: France
Distribution: Ubuntu, Debian
Posts: 239

Rep: Reputation: 23
As haertig mentioned, *testdisk* is what you should try first. It's a *very* powerful tool if you're patient enough (as you might have to test many different configs). And it will always prompt you before actually writing changes to disk. I've used it (successfully) several times and I was amazed each time. Just make sure you read the doc and examples (http://www.cgsecurity.org/wiki/TestDisk) because the interface is a little bit 'spartan'.

Last edited by manu-tm; 03-28-2013 at 07:26 AM.
 
Old 03-28-2013, 03:49 AM   #4
H_TeXMeX_H
Guru
 
Registered: Oct 2005
Location: $RANDOM
Distribution: slackware64
Posts: 12,928
Blog Entries: 2

Rep: Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269
Are you sure the partition isn't '/dev/sda1' ? In which case you would run fsck on that.
 
Old 03-28-2013, 10:30 AM   #5
haertig
Senior Member
 
Registered: Nov 2004
Distribution: Debian, Ubuntu, LinuxMint, Slackware, SysrescueCD
Posts: 2,022

Rep: Reputation: 309Reputation: 309Reputation: 309Reputation: 309
Quote:
Originally Posted by H_TeXMeX_H View Post
Are you sure the partition isn't '/dev/sda1' ?
Good catch! I imagine that runing fsck on /dev/sda would give one no joy. It's those pesky little typos that always bite you! OP - I think H_TeXMex_H has nailed your problem.
 
Old 03-28-2013, 10:42 AM   #6
ccar_support
Member
 
Registered: Jan 2007
Posts: 34

Original Poster
Rep: Reputation: 1
Sorry, that was a typo. I meant to say /dev/sda1

I setup the drive initially so when I did, it was a single 2TB partition formatted for ext3.

The user might have tried to do something but honestly, this person is not that smart. I have to hand hold this individual in changing passwords so messing with the partition is way beyond them.

Granted, I've seen not-so-smart people do crazy stuff so it's possible.

It's not the end of the world if the data is toast but it's definitely worth me giving it a try to recover it. It's good to have an "I owe you one" ready in your back pocket.

I'll read up on testdisk, thanks for the ideas everyone! If anything else comes to mind, I'd love to hear it.

cheers!
 
Old 03-28-2013, 10:58 AM   #7
CrazyNerdGuy
LQ Newbie
 
Registered: Mar 2013
Location: OR, USA
Distribution: -= Gentoo =-
Posts: 4

Rep: Reputation: Disabled
I like photorec, although on a disk that has had multiple installs, you will grab everything from your current data, along w/ data from old installs that has not been overwritten yet. It can be frustrating trying to sort out what is what.

It took me about 6 days to creep through 75% of a 500 meg sata drive til I came to the conclusion my data wasn't worth it. Also you will have to develop skills w/ grep and file carving (which is not exactly learned overnight), to find a handful of files you need, inside millions of random documents/files.

Also be careful that you do not exhaust your existing inodes if saving the recovered files to an disk w/ data on it already. Disks of same size can have different numbers of inodes.
 
Old 03-28-2013, 12:00 PM   #8
haertig
Senior Member
 
Registered: Nov 2004
Distribution: Debian, Ubuntu, LinuxMint, Slackware, SysrescueCD
Posts: 2,022

Rep: Reputation: 309Reputation: 309Reputation: 309Reputation: 309
Quote:
Originally Posted by CrazyNerdGuy View Post
I like photorec, although on a disk that has had multiple installs...
Agreed. If this was a disk with an OS installed on it, it would probably be unmanageable. But if it was a "personal data disk", containing just photos, mp3's, etc., then using photorec becomes much more realistic.
 
Old 03-28-2013, 03:58 PM   #9
ccar_support
Member
 
Registered: Jan 2007
Posts: 34

Original Poster
Rep: Reputation: 1
Ran testdisk and it was able to allow me to mount the partation but no files were present.

I'm giving photorec a shot now and see if there might be a glimmer of hope. If not, I'm throwing in the towel. It's just not that important to me and now it's more of a exercise to learn something new (photorec and testdir are handy tools).

Besides, the user decided to insult me, all my hard work, and effort today. Even if I can recover some files, they will be lucky to actually get them back at this point. I seriously dislike people that act that way.

Thanks for all the helpful info everyone!

I'll post the results once I get there.

cheers
 
Old 03-28-2013, 07:29 PM   #10
haertig
Senior Member
 
Registered: Nov 2004
Distribution: Debian, Ubuntu, LinuxMint, Slackware, SysrescueCD
Posts: 2,022

Rep: Reputation: 309Reputation: 309Reputation: 309Reputation: 309
Quote:
Originally Posted by ccar_support View Post
Besides, the user decided to insult me, all my hard work, and effort today.
Download some porn files, burn them to a CD, then go over to his house to show him the miracles you have completed. But make sure his wife is there at the computer with you guys as you proudly display all the recovered files ... in a cycling slideshow program that you unfortunately forgot how to exit out of!
 
Old 03-29-2013, 02:44 AM   #11
H_TeXMeX_H
Guru
 
Registered: Oct 2005
Location: $RANDOM
Distribution: slackware64
Posts: 12,928
Blog Entries: 2

Rep: Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269
foremost (or its fork 'scalpel') is another option for carving files off the disk.
 
Old 03-29-2013, 03:18 AM   #12
manu-tm
Member
 
Registered: May 2008
Location: France
Distribution: Ubuntu, Debian
Posts: 239

Rep: Reputation: 23
Quote:
Originally Posted by ccar_support View Post
Ran testdisk and it was able to allow me to mount the partation but no files were present.
Testdisk can analyse the drive until files are actually found. (Well, in case it's worth the effort.)
 
Old 03-29-2013, 12:33 PM   #13
ccar_support
Member
 
Registered: Jan 2007
Posts: 34

Original Poster
Rep: Reputation: 1
photorec is actually doing the job. I'm seeing alot of files in the recovery area. Now the question is...do I actually return the files to the user or take haertig's advice? hmmmm

I wish I could but the higher ups may not like that too much! Kudos for the idea haertig! We think alike!

Thanks again for all the help everyone. Case closed!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] drive recovery program tonj Linux - Newbie 3 02-08-2013 04:57 AM
drive failed - attempting recovery draeath Linux - Server 4 06-25-2011 09:18 PM
hard drive problems, recovery possible? fenixbtc Linux - Hardware 7 01-03-2009 05:38 PM
Raid 1 Recovery after a drive failed... Wyntyr Linux - General 2 09-02-2005 04:01 PM
had drive recovery software kflano Linux - Software 0 12-09-2004 09:27 AM


All times are GMT -5. The time now is 08:13 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration