Long time lurker and first time poster, Please correct if I am incorrect.

** Info
Debian 11, 16Gb ram, 240 SSD single partition as root, 3 WD 4Tb drives as data drives. Computer was used as a media / file server.


** Issue
So, I had a WD 4Tb Red Plus HD that began showing symptoms of failure. I was attempting to pull the HD from a live system and the HD would refuse to unmount. I made the mistake of forcing the drive to unmount versus simply restarting the computer.

Rookie mistake I know.

I put the drive into a dock alongside another drive and used DDRescue to create an image of the failing drive. When I went to create the image file I noticed that there was no longer a partition on the drive after using lsblk to determine drive designation for DDRescue. I pulled the data from the failing harddrive from the top level (/dev/sdx vs /dev/sdx1).

DDRescue was able to pull the data with no errors and no badblocks or reruns. It was a single run with no errors.

The old HD has since failed completely and I have the image stored on a seperate HD. I have since been attempting to mount the image or to restore the partition and mount the drive but I seem to have failed at every turn.

Looking for dialog and help in mounting this drive. There is more information but this is becoming a very long post and didnt want to bore the reader. Let me know if you have ideas and I can pass along further information.

Regards,

Steve

If the drive is for data it should be possible to unmount as long as the filesystem was not being accessed.
If you were attempting to pull the drive from a live system is it USB or internal?

Do the drives have "separate" filesystems or are they part of a RAID or LVM?

What errors are you getting when you try to mount? What filesystem is there on the partition? The image you created is for just the partition or for the entire disk?
What does fsck say when you run it against the image file?

The drive was a single storage unit and not part of raid, zfs, or lvm.

The drive has / had an ext4 file system with one partition.

The image was for the top level because it didn't show any partitions. So I used DDRescue to grab /dev/sdx versus /dev/sdx1.

A. The error that I continue to recieve is "wrong fs type, bad option, bad superblock on /dev/sdbx, missing codepage or helper program, or other error" I receive this error in three different places.

1. When I attempt to mount the top level (/dev/sdx) after I dd - extract the image to a new harddrive.
2. When I attempt to create a partition that was exactly like the removed partition
3. When I attempt to mount the image directly using "mount -t ext4 -o ro,loop img.file"

I have successfully queried the superblocks for the device and have used dumpe2fs and found 3 superblocks that are readable by the system.

I have attempted to use Testdisk, HirensBootCD, and a few other recovery options to no avail.

I have attempted to e2fsck and fsck.ext4 the device with a usable superblock and this causes the device to "clean up" the file system and I can mount the device after that at the top level (/dev/sdx) but everything is placed in the (lost and found) folders. After querying the (Lost and Found) folders only a quarter of my data is available.

This is all I have so far.

Thank you for reading!

You should be able to dd the img file to another (whole) drive of equal or larger size than the original.

I think you should mount it with mount -o loop ro -t ext4 imgfile

Edit: It's been a while since I've done this...

Which is different from your first post..
I see now why it refused to unmount.

You can not mount the "top level" i.e /dev/sdx directly if the image contains a partition table etc. To mount one partition from a entire drive image you need to use the kpartx utility which basically calculates where the partitions lies on the disk and creates the loop devices. You then mount the loop device as shown from the output of the command.

I assume the SSD is an internal drive. If I understood what you posted, SATA does have hot plug capability but the computer must also support hot plug as well. With some BIOS, hot plug must be enabled which many do not do by default.

You need to define an offset for the partition when mounting it from a disk image of the whole drive. Run the following command:

and it will give an output something like:

Now we need to calculate the offset from the to the partition start in the image file. To do that, you need to calculate the following

Once we have the offset we can mount the partition on /dev/loop0 using the following command:

Now the partition resides on /dev/loop0. You can fsck it, mount it etc

I have used this in the past to mount partitions from images (I create an image of the disk if I am ever doing anything 'risky' with the drive as a backup)

- Suramya

When I perform FDisk -lu on the image file I get the following information

-----------
administrator@OPENMEDIAVAULT:/mnt/backup/$ sudo fdisk -lu data.img
Disk data.img: 3.64 TiB, 4000785104896 bytes, 7814033408 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
----------

I have attempted to perform the offset to mount the image in loop using:

1. mount -o loop,offset=X /dev/sdx mountpnt/
2. kparx
3. losetup
4. mount -o sb=X,ro /dev/sdx mountpnt/

It seems it can't find a partition to mount. As a side note after I have ran e2fsck it allows me to mount at the "top level" /dev/sdx which I thought was weird.

I am loath to perform any functions on the raw image file because it's the only one I have. So I have been mounting the device it is on as read only and then copying the file over to another HD

As a note, I appreciate everyone helping. I am grateful! I can't be the only person on the planet that this has happend to so I am hoping to find a resolution here with people far more advanced than myself.

Thank you again.

A 4TB disk should be using GPT partitioning and if you do not see type gpt or partition information then it is either corrupted or maybe was not partitioned.
What does the output of the command file show i.e.
sudo file data.img

The result of the File command simply shows:
------
administrator@OPENMEDIAVAULT:/mnt/backup/$ sudo file data.img
data.img: data
administrator@OPENMEDIAVAULT:/mnt/backup/$
------

I used gdisk to find out about the file infrastructure and this is what it shows:

-----
administrator@OPENMEDIAVAULT:/mnt/backup/$ sudo gdisk data.img
GPT fdisk (gdisk) version 1.0.6

NOTE: Write test failed with error number 30. It will be impossible to save
changes to this disk's partition table!

Warning: Partition table header claims that the size of partition table
entries is 2598990484 bytes, but this program supports only 128-byte entries.
Adjusting accordingly, but partition table may be garbage.
Warning: Partition table header claims that the size of partition table
entries is 2361226031 bytes, but this program supports only 128-byte entries.
Adjusting accordingly, but partition table may be garbage.
Partition table scan:
MBR: not present
BSD: not present
APM: not present
GPT: not present

Creating new GPT entries in memory.

Command (? for help): i
No partitions

Command (? for help): p
Disk data.img: 7814033408 sectors, 3.6 TiB
Sector size (logical): 512 bytes
Disk identifier (GUID): 2FA9C442-E414-400E-A3C8-2D3F1C9838D3
Partition table holds up to 128 entries
Main partition table begins at sector 2 and ends at sector 33
First usable sector is 34, last usable sector is 7814033374
Partitions will be aligned on 2048-sector boundaries
Total free space is 7814033341 sectors (3.6 TiB)

Number Start (sector) End (sector) Size Code Name

-------

Fdisk shows much the same but apparently it doesn't work well with large disk i think...(I read somewhere while forum surfing)?



I created a partition on the drive that I DD-extracted the image to in order to see if simply recreating the partition would show the data on the disk. That failed, it wants me to run e2fsck on both /dev/sdx and /dev/sdx1. After running e2fsck on both the results are mixed. In one instance the disk was clean and had many entries in the Lost and Found folder. After combing through the lost and found folders I could retrieve maybe a quarter of my data. The other instance simply says the drive is corrupt and unable to be repaired. The error states that either the GPT partition or superblock is corrupt.

-------

administrator@OPENMEDIAVAULT:/mnt/backup$ sudo gdisk /dev/sdc
GPT fdisk (gdisk) version 1.0.6

Partition table scan:
MBR: protective
BSD: not present
APM: not present
GPT: present

Found valid GPT with protective MBR; using GPT.

Command (? for help): i
Using 1
Partition GUID code: 0FC63DAF-8483-4772-8E79-3D69D8477DE4 (Linux filesystem)
Partition unique GUID: B98917A1-99CF-4C94-958B-EC511CED0D1E
First sector: 4096 (at 2.0 MiB)
Last sector: 7814033408 (at 3.6 TiB)
Partition size: 7814029313 sectors (3.6 TiB)
Attribute flags: 0000000000000000
Partition name: 'Linux filesystem'

Command (? for help): p
Disk /dev/sdc: 7814037168 sectors, 3.6 TiB
Model: EFRX-68N32N0
Sector size (logical/physical): 512/512 bytes
Disk identifier (GUID): 45267B9A-4FA2-46E3-8AD4-BB7689191BB9
Partition table holds up to 128 entries
Main partition table begins at sector 2 and ends at sector 33
First usable sector is 34, last usable sector is 7814037134
Partitions will be aligned on 2048-sector boundaries
Total free space is 7788 sectors (3.8 MiB)

Number Start (sector) End (sector) Size Code Name
1 4096 7814033408 3.6 TiB 8300 Linux filesystem

Command (? for help):
------------------------

Sorry, it is alot of information kind of jumbled up. Hopefully it makes some sense.

Thank you again!

So the information from gfdisk is after you recreated the GPT partition table?

It appears the filesystem has been corrupted.

The GPT partition is "new" after the DD-extract.

The image file is on another disk and I copy or extract the file as I need to for testing. I do not, as far as I know, do anything to the image file.

I am starting to think the same sadly that it is corrupted ... I am currently nearly out of options.

Is their a way to repair or correct outside of e2fsck?

Like I mentioned earlier I can't be the only person that has had this pop-up. Hopefully we can find a resolution, **fingers crossed**

Thank you again!

Wonder what testdisk would do on it? https://www.cgsecurity.org/wiki/TestDisk_FAQ

I was thinking something similar and if testdisk could find the backup superblocks.

Unfortunatly Testdisk was a bust. I ran it on both regular and deep scan. I also tried different variations of disk type and it would not pull a partition.

I do have the list of superblocks and found 3 that do work when I run e2fsck and dumpe2fs. Oddly enough they only seem to work on the "top-level" of the drive i.e. (/dev/sdx).

Testdisk did not find any partitions and e2fsck doesnt properly repair the drives filesystem.

Thanks for your help ... still looking for solutions.