LinuxQuestions.org

LinuxQuestions.org (http://www.linuxquestions.org/questions/index.php)
-   Linux - Hardware (http://www.linuxquestions.org/questions/forumdisplay.php?f=18)
-   -   Drive recovery? (http://www.linuxquestions.org/questions/showthread.php?t=4175455837)

ccar_support 03-27-2013 04:35 PM

Drive recovery?
 
Not sure what the user did but I've got a 2TB drive that is not playing nice.

Western Digital WD2001FASS 2TB drive
was formatted with a single ext3 partition
When I run off System Rescue CD x86 with the drive connected, fdisk shows the partition still there but I cannot do anything else.

e2fsck results in:
---------------
fsck.ext2: Superblock invalid, trying backup blocks
fsck.ext2: Bad magic number in super-block while trying to open /dev/sda

Superblock could not be read or does not describe a correct ext2 filesystem.
---------------

I also ran mke2fs -n on it and it provided a long list of superblocks available but when I run e2fsck -b with the block specified, it still says "Superblock invalid".

Is there any hope of recovering the data on this drive or is this a lost cause?

haertig 03-27-2013 09:25 PM

How important is the data on the disk? Your best chances of recovery without further damage to the disk are to first do a bit-by-bit copy of it to a second drive. Then work on the copy, preserving the original in it's current shape in case you need to go back and start over. Buying another 2Tb disk may cost more money than you're willing to spend to recover this data.

You said the disk was formatted as a single ext3 partition. I assume the user told you this? The same user that somehow screwed up the data without knowing what happened? I would take what they say with a grain of salt - definitely consider the experience level, and honesty, of your user. Did they possibly change the partitions and then come to you for help without mentioning the "embarassing" stuff they did? I've seen it happen.

On the copy disk, I would first try running "testdisk" to see what it comes up with for previous partitions. You can also use "photorec" (it's not just for photos) to recover files from a partitionless disk. If you run photorec, you will need a place for it to store the recovered files. So that means ANOTHER hard disk. So this could get expensive if you don't have all those spare 2Tb hard disks laying around. Is the data worth it?

manu-tm 03-27-2013 10:12 PM

As haertig mentioned, *testdisk* is what you should try first. It's a *very* powerful tool if you're patient enough (as you might have to test many different configs). And it will always prompt you before actually writing changes to disk. I've used it (successfully) several times and I was amazed each time. Just make sure you read the doc and examples (http://www.cgsecurity.org/wiki/TestDisk) because the interface is a little bit 'spartan'.

H_TeXMeX_H 03-28-2013 03:49 AM

Are you sure the partition isn't '/dev/sda1' ? In which case you would run fsck on that.

haertig 03-28-2013 10:30 AM

Quote:

Originally Posted by H_TeXMeX_H (Post 4920367)
Are you sure the partition isn't '/dev/sda1' ?

Good catch! I imagine that runing fsck on /dev/sda would give one no joy. It's those pesky little typos that always bite you! OP - I think H_TeXMex_H has nailed your problem.

ccar_support 03-28-2013 10:42 AM

Sorry, that was a typo. I meant to say /dev/sda1

I setup the drive initially so when I did, it was a single 2TB partition formatted for ext3.

The user might have tried to do something but honestly, this person is not that smart. I have to hand hold this individual in changing passwords so messing with the partition is way beyond them.

Granted, I've seen not-so-smart people do crazy stuff so it's possible.

It's not the end of the world if the data is toast but it's definitely worth me giving it a try to recover it. It's good to have an "I owe you one" ready in your back pocket.

I'll read up on testdisk, thanks for the ideas everyone! If anything else comes to mind, I'd love to hear it.

cheers!

CrazyNerdGuy 03-28-2013 10:58 AM

I like photorec, although on a disk that has had multiple installs, you will grab everything from your current data, along w/ data from old installs that has not been overwritten yet. It can be frustrating trying to sort out what is what.

It took me about 6 days to creep through 75% of a 500 meg sata drive til I came to the conclusion my data wasn't worth it. Also you will have to develop skills w/ grep and file carving (which is not exactly learned overnight), to find a handful of files you need, inside millions of random documents/files.

Also be careful that you do not exhaust your existing inodes if saving the recovered files to an disk w/ data on it already. Disks of same size can have different numbers of inodes.

haertig 03-28-2013 12:00 PM

Quote:

Originally Posted by CrazyNerdGuy (Post 4920583)
I like photorec, although on a disk that has had multiple installs...

Agreed. If this was a disk with an OS installed on it, it would probably be unmanageable. But if it was a "personal data disk", containing just photos, mp3's, etc., then using photorec becomes much more realistic.

ccar_support 03-28-2013 03:58 PM

Ran testdisk and it was able to allow me to mount the partation but no files were present.

I'm giving photorec a shot now and see if there might be a glimmer of hope. If not, I'm throwing in the towel. It's just not that important to me and now it's more of a exercise to learn something new (photorec and testdir are handy tools).

Besides, the user decided to insult me, all my hard work, and effort today. Even if I can recover some files, they will be lucky to actually get them back at this point. I seriously dislike people that act that way.

Thanks for all the helpful info everyone!

I'll post the results once I get there.

cheers

haertig 03-28-2013 07:29 PM

Quote:

Originally Posted by ccar_support (Post 4920716)
Besides, the user decided to insult me, all my hard work, and effort today.

Download some porn files, burn them to a CD, then go over to his house to show him the miracles you have completed. But make sure his wife is there at the computer with you guys as you proudly display all the recovered files ... in a cycling slideshow program that you unfortunately forgot how to exit out of! :)

H_TeXMeX_H 03-29-2013 02:44 AM

foremost (or its fork 'scalpel') is another option for carving files off the disk.

manu-tm 03-29-2013 03:18 AM

Quote:

Originally Posted by ccar_support (Post 4920716)
Ran testdisk and it was able to allow me to mount the partation but no files were present.

Testdisk can analyse the drive until files are actually found. (Well, in case it's worth the effort.)

ccar_support 03-29-2013 12:33 PM

photorec is actually doing the job. I'm seeing alot of files in the recovery area. Now the question is...do I actually return the files to the user or take haertig's advice? hmmmm

I wish I could but the higher ups may not like that too much! Kudos for the idea haertig! We think alike!

Thanks again for all the help everyone. Case closed!


All times are GMT -5. The time now is 09:39 PM.