Partitions suddenly have another filesystem

geofyt · 12-30-2014, 06:28 AM

Hello there,

For some reason, probably hard drive issues, my partitions got messed up.

Code:

fdisk -l /dev/sda

outputs:

Code:

Disk /dev/sda: 160.0 GB, 160041885696 bytes
65 heads, 26 sectors/track, 184959 cylinders, total 312581808 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x000324ae

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *        2048   156293119    78145536    7  HPFS/NTFS/exFAT
/dev/sda2       156293120   197967871    20837376    7  HPFS/NTFS/exFAT
/dev/sda3       197967872   239642623    20837376   83  Linux
/dev/sda4       239644670   312578047    36466689    f  W95 Ext'd (LBA)
/dev/sda5       239644672   281319423    20837376    6  FAT16
/dev/sda6       281321472   286531583     2605056   82  Linux swap / Solaris
/dev/sda7       286533632   312578047    13022208    6  FAT16

/dev/sda4 used to be an extended partition holding partition 5, 6 and 7. Sda5 and sda7 should be Linux partitions, formatted with Reiserfs. Im not 100% sure of Reiserfs: I havent used the computer in a while. I know I havent made any changes to the partitions, nor did I write data to them.

As the way things look now, can my data be saved? If so, what can I do?

If more information is needed, please ask.
Help appreciated

Head_on_a_Stick · 12-30-2014, 06:34 AM

I don't speak German; please post the output of:

Code:

# LC_ALL=C fdisk -l /dev/sda

geofyt · 12-30-2014, 06:52 AM

Quote:

Originally Posted by Head_on_a_Stick

I don't speak German; please post the output of:

Code:

# LC_ALL=C fdisk -l /dev/sda

My bad. Fixed now.

Head_on_a_Stick · 12-30-2014, 06:58 AM

What is the output of:

Code:

# LC_ALL=C blkid

Also, which distribution are you using?

veerain · 12-30-2014, 07:26 AM

Just mount the partition with mount command it would automatically find which filesystem the partition has and mount it.

mount /dev/sda5 /mnt

if it doesn't works then changing partition type is easy; just start fdisk and change partition; I think 't' is command to change partition types. Anyway fdisk has inbuilt help.

geofyt · 12-30-2014, 07:29 AM

Code:

$blkid
/dev/sda1: UUID="A8766F06766ED51A" TYPE="ntfs" 
/dev/sda2: LABEL="Documenten" UUID="1C1A838C1A83619E" TYPE="ntfs" 
/dev/sda3: UUID="a8bcfb46-6c31-45ab-af1d-db825d1e8ab4" TYPE="ext4"

I'm using Mint Linux.

geofyt · 12-30-2014, 07:34 AM

Quote:

Originally Posted by veerain

Just mount the partition with mount command it would automatically find which filesystem the partition has and mount it.

mount /dev/sda5 /mnt

if it doesn't works then changing partition type is easy; just start fdisk and change partition; I think 't' is command to change partition types. Anyway fdisk has inbuilt help.

I already tried this, but mount says it cannot determine the filesystem. Changing the type with fdisk also crossed my mind, but I don't want to do anything destructive.

Head_on_a_Stick · 12-30-2014, 07:44 AM

That's strange -- I have a laptop with extended (MBR) partitions and they show up in `blkid`

Can you "see" them in gparted?

I'm probably missing something here...

geofyt · 12-30-2014, 07:55 AM

GParted sees them indeed:

Click image for larger version

Name: 1.png
Views: 26
Size: 29.6 KB
ID: 17241

note: what cannot be seen in the screenshot is that sda1 has "boot" and sda4 "lba" as flag

Head_on_a_Stick · 12-30-2014, 07:59 AM

Looks like the filesystem has gone -- I think you're out of luck here.

Plenty of users much more expert than I on this forum though, so hopefully they'll prove me wrong.

Interesting link here:
http://arstechnica.com/uncategorized...ops-to-corpse/
I think it's fair to say it is no longer under active development...

geofyt · 12-30-2014, 08:12 AM

Quote:

Looks like the filesystem has gone

Yeah, I already had little hope. But hopefully someone has a solution.

Quote:

I think you're out of luck here.

Yup. And I'm out of luck elsewhere too: its backup device broke yesterday.

Thanks for your time and help.

If anyone has anything to add, please do. In the meanwhile I'll search on.

unSpawn · 12-30-2014, 08:53 AM

Interesting. Can you post:

Code:

reiserfsck --check --scan-whole-partition --logfile /tmp/fsck.txt /dev/sda5
debugreiserfs -dDom /dev/sda5
hexdump -C /dev/sda5|grep -i reiser

Please read the manual pages for each command if unsure before executing it, do not add additional switches and cancel each operation and do not proceed if you encounter errors and attach or post output between BB code tags.
*If you have a spare medium around with enough free space you can create per partition copies to file. That could come in handy later on. Attach and mount writable internal or external USB, firewire or other type of disk, then:

Code:

dd if=/dev/sda5 conv=noerror of=/whatever_mount_point_/sda5.dd
dd if=/dev/sda7 conv=noerror of=/whatever_mount_point_/sda7.dd

*Note if you encounter errors and have dd_rescue or ddrescue available you best read the manual page and proceed to use those.

geofyt · 12-30-2014, 10:05 AM

reiserfsck

Code:

reiserfsck --check --scan-whole-partition --logfile /tmp/fsck.txt /dev/sda5

This does nothing. It outputs the same as "reiserfsck -h".

However, when I omit --scan-whole-partition, it outputs:

Code:

reiserfsck 3.6.24

Will read-only check consistency of the filesystem on /dev/sda5
Will put log info to '/tmp/fsck.txt'

Do you want to run this program?[N/Yes] (note need to type Yes if you do):Yes

reiserfs_open: the reiserfs superblock cannot be found on /dev/sda5.
Failed to open the filesystem.

If the partition table has not been changed, and the partition is
valid  and  it really  contains  a reiserfs  partition,  then the
superblock  is corrupted and you need to run this utility with
--rebuild-sb.

Nothing had been written to the output file.

debugreiserfs

Code:

# debugreiserfs -dDom /dev/sda5
debugreiserfs 3.6.24

reiserfs_open: the reiserfs superblock cannot be found on /dev/sda5.

debugreiserfs: can not open reiserfs on "/dev/sda5": no filesystem found

The same goes for /dev/sda7. It makes me doubt whether they truly were reiserfs. As said, it was a long time since I used them and I have no fstab where I can look it up. If not reiserfs, then it would be ext3. I am sure it's either one of those.

Hexdump and DD
Hexdump is still running for /dev/sda5 and has been for some time now.

I do have a spare disk laying around which I'll attach later on so I can DD those partitions. I can create identical partitions on the spare disk. Or is this not necessary?

Will be back. Thanks.

unSpawn · 12-30-2014, 11:28 AM

Quote:

Originally Posted by geofyt

It makes me doubt whether they truly were reiserfs. As said, it was a long time since I used them and I have no fstab where I can look it up. If not reiserfs, then it would be ext3. I am sure it's either one of those.

How long ago?
Why don't you have /etc/fstab?
Do you have backups?
Did you try running:

Code:

dumpe2fs /dev/sda5

If you have testdisk and photorec installed you should read http://www.cgsecurity.org/wiki/TestDisk, http://www.cgsecurity.org/wiki/Running_TestDisk and http://www.cgsecurity.org/wiki/Menu_Analyse and then try

Code:

testdisk /debug /log /dev/sda5

but don't save anything just run analysis then quit and check / post the log file.

Quote:

Originally Posted by geofyt

Hexdump is still running for /dev/sda5 and has been for some time now.

Well then you can quit it. Unless it's a 1980-era disk it's way past the superblock.

Quote:

Originally Posted by geofyt

I do have a spare disk laying around which I'll attach later on so I can DD those partitions. I can create identical partitions on the spare disk. Or is this not necessary?

The idea is to make an exact copy of the partitions to files. That way you have backups and you can then safely experiment on the disk or vice versa, whatever you like.

geofyt · 12-30-2014, 12:50 PM

Quote:

Hexdump is still running for /dev/sda5 and has been for some time now.

No results here indeed, unSpawn.

Quote:

How long ago?

PFff, I think about a year, or so.

Quote:

Why don't you have /etc/fstab?

It's not that I don't have /etc/fstab at all though

For this Linux install there is one. But I last used /dev/sda5 and /dev/sda7 in my former Linux setup, which contained the mount info for these drives. I installed a new Linux and never got around mounting them.

Quote:

Do you have backups?

I had backups. My backup device broke yesterday.

dumpe2fs

Code:

#dumpe2fs /dev/sda5
dumpe2fs 1.42.9 (4-Feb-2014)
dumpe2fs: Bad magic number in super-block while trying to open /dev/sda5
Couldn't find valid filesystem superblock.

Testdisk

Quote:

but don't save anything just run analysis then quit and check / post the log file.

This is seen after running the analyzer within the program:

Code:

Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63
Current partition structure:
     Partition                  Start        End    Size in sectors

Warning: number of heads/cylinder mismatches 65 (NTFS) != 255 (HD)
Warning: number of sectors per track mismatches 26 (NTFS) != 63 (HD)
 1 * HPFS - NTFS              0  32 33  9728 203 11  156291072

Bad relative sector.
Warning: number of heads/cylinder mismatches 65 (NTFS) != 255 (HD)
Warning: number of sectors per track mismatches 26 (NTFS) != 63 (HD)
 2 P HPFS - NTFS           9728 203 12 12322 237 11   41674752 [Documenten]
 3 P Linux                12322 237 12 14917  16 11   41674752
 4 E extended LBA         14917  48 42 19457  21 20   72933378
Invalid FAT boot sector
 5 L FAT16 >32M           14917  48 44 17511  82 43   41674752
 5 L FAT16 >32M           14917  48 44 17511  82 43   41674752
   X extended             17511 104 14 17835 195 24    5210804
 6 L Linux Swap           17511 115 13 17835 195 24    5210112
 6 L Linux Swap           17511 115 13 17835 195 24    5210112
   X extended             17835 213 47 19457  21 20   26045308
Invalid FAT boot sector
 7 L FAT16 >32M           17835 227 57 19457  21 20   26044416
 7 L FAT16 >32M           17835 227 57 19457  21 20   26044416

This is the complete log:testdisk.log