LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 02-24-2017, 01:03 PM   #1
GNewbie
Member
 
Registered: Sep 2005
Distribution: (U/K/X)buntu 6.1 (newer box) / D*mn Small Linux (older box)
Posts: 318

Rep: Reputation: 31
Hard Drive Rehab Effort after Crash


Hi All,

I have a hard drive I'm trying to rehabilitate after it crashed. Primarily, I want to try and get my Thunderbird files off of it, but it would be nice to get a few other files off of it as well.

I created an image on a new hard drive and I've copied the image to a third hard drive.

One option is to try and testdisk on the image, but the tutorials I've found focus on running testdisk on the partition, not on an image file within a partition. If anyone is aware of an online tool that discusses running testdisk against an image on a partition, I would appreciate posting a link to this thread.

As it stands now, I have the non-compliant hard drive attached as a USB device to my computer (with another hard drive).

sda7 is the corrupted home partition. I've been told the problem is likely a disk error. The partitions on the drive don't automatically mount. When I try to manually mount sda7, I get the following output:

Code:
~ $ sudo mount -t ext4 /dev/sda7 /mnt/homebu
mount: wrong fs type, bad option, bad superblock on /dev/sda7,
       missing codepage or helper program, or other error

       In some cases useful info is found in syslog - try
       dmesg | tail or so.
BTW, I'm pretty sure the file type is ext4. Just in case, I ran the same command with ext3 and received the same result.

Can anyone share any troubleshooting advice?

TIA...

Edited to add: what is the nomenclature to run a linux command against an image on a partition, as opposed to the partition itself?

Last edited by GNewbie; 02-24-2017 at 01:12 PM.
 
Old 02-24-2017, 01:18 PM   #2
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 4,362

Rep: Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001
You can run testdisk on an image file. You will need to include the file name on the command line, and you should go to the "Geometry" menu and set the parameters to match what was in use for the original disk. testdisk remains wedded to C/H/S geometry, and can behave strangely if the geometry doesn't match the way the partitioning was originally set up.
 
Old 02-24-2017, 01:18 PM   #3
SilentSam
Member
 
Registered: Aug 2007
Location: Ottawa
Distribution: Arch Linux/Kubuntu/OpenSUSE
Posts: 300

Rep: Reputation: 37
First off, confirm the FS type:

Code:
sudo parted -l
Or use gparted, which is an excellent tool.

Mounting an image depends on how you generated it. I'm assuming you used dd to create your image here. Images need to be mounted as loop devices, so

Code:
sudo mount /path/to/image.img /mnt/folder -o loop
Most distros ship mount that can autodetect the filesystem in the image. You can obviously specify the filesystem type using -t should the autodetection fail.
 
Old 02-24-2017, 02:19 PM   #4
GNewbie
Member
 
Registered: Sep 2005
Distribution: (U/K/X)buntu 6.1 (newer box) / D*mn Small Linux (older box)
Posts: 318

Original Poster
Rep: Reputation: 31
Hi All, thanks for the input.

I followed the instructions in this video on the actual drive itself (not the copied image)...

Test Disk - How to Recover Files from a Faulty Hard-Drive
https://www.youtube.com/watch?v=Exq-aWBmRyI

...and I ended up with the following error when I tried to access sda7 (my damaged home drive location):

Code:
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

 7 L Linux                 4802  96 31 114221   8 27 1757810688

Can't open filesystem. Filesystem seems damaged.

>[  Quit  ]
                               Quit this section
re: SilentSam

It is ext4. Here is the output of "sudo parted -l"

Code:
Model: WDC WD10 EZEX-00RKKA0 (scsi)
Disk /dev/sdd: 1000GB
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Disk Flags: 

Number  Start   End     Size    Type      File system  Flags
 1      1049kB  500MB   499MB   primary   ext4         boot
 2      501MB   939GB   939GB   extended
 5      501MB   15.5GB  15.0GB  logical   ext4
 6      15.5GB  39.5GB  24.0GB  logical
 7      39.5GB  939GB   900GB   logical   ext4
I will try and mount the image using the method you recommend. Once it is mounted, will testdisk pick it up as a partition? Also, given that testdisk can't read the original hard drive partition, it looks like I won't be able to recover files from the drive, rather, I'll need to focus on trying to rehabilitate the partition.

re: rknichols

>>You can run testdisk on an image file. You will need to include the file name on the command line,<<

You mean like

Code:
testdisk /dev/sdc3/homebackup.img
Do I need any sort of flag? Can you post a link to an example? I'm brand new at this, but I realize the world of hurt I can create if I make a wrong move out of nescience.

>>and you should go to the "Geometry" menu and set the parameters to match what was in use for the original disk. testdisk remains wedded to C/H/S geometry, and can behave strangely if the geometry doesn't match the way the partitioning was originally set up.<<

I presume you refer to the "Geometry" option in the listing that lists "Analyse" and "Advanced" above "Geometry."

Does the image itself retain the hd parameters, or do I need to get those parameters from the original hard drive? By "parameters," do you mean the start and stop location of the partition? I believe I can used fdisk on the original drive to get those values. I also presume that testdisk provides a place to enter these values after selecting "Geometry."
 
Old 02-24-2017, 04:41 PM   #5
SilentSam
Member
 
Registered: Aug 2007
Location: Ottawa
Distribution: Arch Linux/Kubuntu/OpenSUSE
Posts: 300

Rep: Reputation: 37
Quote:
Originally Posted by GNewbie View Post
Code:
testdisk /dev/sdc3/homebackup.img
Do I need any sort of flag? Can you post a link to an example? I'm brand new at this, but I realize the world of hurt I can create if I make a wrong move out of nescience.

>>and you should go to the "Geometry" menu and set the parameters to match what was in use for the original disk. testdisk remains wedded to C/H/S geometry, and can behave strangely if the geometry doesn't match the way the partitioning was originally set up.<<

I presume you refer to the "Geometry" option in the listing that lists "Analyse" and "Advanced" above "Geometry."

Does the image itself retain the hd parameters, or do I need to get those parameters from the original hard drive? By "parameters," do you mean the start and stop location of the partition? I believe I can used fdisk on the original drive to get those values. I also presume that testdisk provides a place to enter these values after selecting "Geometry."
Code:
silentsam@lq:~$ sudo testdisk /list /dev/sdb1
[sudo] password for silentsam: 
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Please wait...
Disk /dev/sdb1 - 1998 MB / 1905 MiB - CHS 1015 62 62
Sector size:512
Model: Kingston DataTraveler 2.0, FW:PMAP

Disk /dev/sdb1 - 1998 MB / 1905 MiB - CHS 1015 62 62
     Partition			Start        End    Size in sectors
   P FAT32                    0   0  1  1015  29 29    3903487 [SYSRESC]
     FAT32, blocksize=4096
Or, if the image was the entire disk:

Code:
silentsam@lq:~$ sudo testdisk /list /dev/sdb
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Please wait...
Disk /dev/sdb - 1998 MB / 1906 MiB - CHS 1015 62 62
Sector size:512
Model: Kingston DataTraveler 2.0, FW:PMAP

Disk /dev/sdb - 1998 MB / 1906 MiB - CHS 1015 62 62
     Partition			Start        End    Size in sectors
 1 * FAT32 LBA                0   0  2  1015  29 30    3903487 [SYSRESC]
     FAT32, blocksize=4096
It's the value CHS 1015 62 62 that would need to be correct. You can retrieve the proper values directly from the disk much like I did. If I took an image of this drive, I would need to ensure that in Geometry it's set up correctly in TestDisk when accessing the image.

edit:
Code:
testdisk /dev/sdc3/homebackup.img
Wouldn't work. You need to point to the actual path... ie:

Code:
sudo testdisk /home/user/homebackup.img
or something similar.

Last edited by SilentSam; 02-24-2017 at 04:44 PM.
 
Old 02-24-2017, 05:11 PM   #6
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 4,362

Rep: Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001
Quote:
Originally Posted by GNewbie View Post
re: rknichols

>>You can run testdisk on an image file. You will need to include the file name on the command line,<<

You mean like

Code:
testdisk /dev/sdc3/homebackup.img
Do I need any sort of flag? Can you post a link to an example? I'm brand new at this, but I realize the world of hurt I can create if I make a wrong move out of nescience.
That's all you need. testdisk will come up offering that file as the only "device" option.

testdisk won't write anything to the file or device unless you tell it to. If you're rebuilding the partition table, you have to tell it to write out the new table. If you're recovering files, you have to tell it where to put them.
 
Old 02-26-2017, 02:46 PM   #7
GNewbie
Member
 
Registered: Sep 2005
Distribution: (U/K/X)buntu 6.1 (newer box) / D*mn Small Linux (older box)
Posts: 318

Original Poster
Rep: Reputation: 31
Hi SilentSam and rknichols,

I followed the instructions below and was able to retrieve the CHS value without a problem.

However, I'm having a problem when it comes to pointing testdisk to the homebackup.img file.

I couldn't figure out the directory path, so I did some searching and used the following to retrieve what I thought would be the directory path.

Code:
readlink -f file.txt
It returned...
Code:
/home/user/homebackup.img
When I directed testdisk towards the image, I received the following error message...

Code:
user@user-desktop ~ $ sudo testdisk /home/user/homebackup.img
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Unable to open file or device /home/user/homebackup.img: No such file or directory
user@user-desktop ~ $
Do you have any ideas as to how I can proceed?

TIA...


Quote:
Originally Posted by SilentSam View Post
Code:
silentsam@lq:~$ sudo testdisk /list /dev/sdb1
[sudo] password for silentsam: 
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Please wait...
Disk /dev/sdb1 - 1998 MB / 1905 MiB - CHS 1015 62 62
Sector size:512
Model: Kingston DataTraveler 2.0, FW:PMAP

Disk /dev/sdb1 - 1998 MB / 1905 MiB - CHS 1015 62 62
     Partition			Start        End    Size in sectors
   P FAT32                    0   0  1  1015  29 29    3903487 [SYSRESC]
     FAT32, blocksize=4096
Or, if the image was the entire disk:

Code:
silentsam@lq:~$ sudo testdisk /list /dev/sdb
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Please wait...
Disk /dev/sdb - 1998 MB / 1906 MiB - CHS 1015 62 62
Sector size:512
Model: Kingston DataTraveler 2.0, FW:PMAP

Disk /dev/sdb - 1998 MB / 1906 MiB - CHS 1015 62 62
     Partition			Start        End    Size in sectors
 1 * FAT32 LBA                0   0  2  1015  29 30    3903487 [SYSRESC]
     FAT32, blocksize=4096
It's the value CHS 1015 62 62 that would need to be correct. You can retrieve the proper values directly from the disk much like I did. If I took an image of this drive, I would need to ensure that in Geometry it's set up correctly in TestDisk when accessing the image.

edit:
Code:
testdisk /dev/sdc3/homebackup.img
Wouldn't work. You need to point to the actual path... ie:

Code:
sudo testdisk /home/user/homebackup.img
or something similar.
 
Old 02-26-2017, 06:17 PM   #8
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 4,362

Rep: Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001
I find it hard to believe you could go to all the effort of making an image file and not know where you put it. Earlier, you said,
Quote:
Originally Posted by GNewbie View Post
I created an image on a new hard drive and I've copied the image to a third hard drive.
Are either of those images ordinary files, or did you just make each of those two drives an image of the original? Did you even create a file named "homebackup.img"? It's also not apparent how a symbolic link with the unlikely name of "file.txt" was created with a target of "/home/user/homebackup.img". Note that you can create a symbolic link with any arbitrary text as the "target". It doesn't have to point to anything that exists.

Just how did you create and copy those images, and what created that "file.txt" link?
 
Old 02-27-2017, 11:24 AM   #9
GNewbie
Member
 
Registered: Sep 2005
Distribution: (U/K/X)buntu 6.1 (newer box) / D*mn Small Linux (older box)
Posts: 318

Original Poster
Rep: Reputation: 31
Quote:
Originally Posted by rknichols View Post
I find it hard to believe you could go to all the effort of making an image file and not know where you put it. Earlier, you said,
Are either of those images ordinary files, or did you just make each of those two drives an image of the original? Did you even create a file named "homebackup.img"? It's also not apparent how a symbolic link with the unlikely name of "file.txt" was created with a target of "/home/user/homebackup.img". Note that you can create a symbolic link with any arbitrary text as the "target". It doesn't have to point to anything that exists.

Just how did you create and copy those images, and what created that "file.txt" link?
Hi rknichols, you don't have to believe the hard to believe. I know right were it is, but only in a sense. It is on a partition in my USB harddrive. I can navigate to it with no problem.

The problem I have is that I can't use a directory path that linux understands.

My apologies. I copied the tutorial example and not what I actually input - my mistake.

I actually typed this (sorry for the confusion):

Code:
readlink -f homebackup.img
I used dd to created the images.

So, before causing the confusion, I'm left with the readlink program yielding the following as my path:

Code:
/home/user/homebackup.img
But the following command line input doesn't work because linux doesn't see the image file:

Code:
testdisk /home/user/homebackup.img
I must be confused regarding the directory path that linux expects as input in order to point at homebackup.img.

How do I nail down that path since readlink apparently didn't do it?

TIA and sorry about the confusion caused when I didn't update the file name of the example I used to do my own readlink search.
 
Old 02-27-2017, 11:50 AM   #10
suicidaleggroll
LQ Guru
 
Registered: Nov 2010
Location: Colorado
Distribution: OpenSUSE, CentOS
Posts: 5,573

Rep: Reputation: 2137Reputation: 2137Reputation: 2137Reputation: 2137Reputation: 2137Reputation: 2137Reputation: 2137Reputation: 2137Reputation: 2137Reputation: 2137Reputation: 2137
Ignore readlink, that's used for following symbolic links, which you don't have. All it's telling you is your current location, it's not telling you anything about any actual file that exists on the system. You could run "readlink -f blahtyblahtyblahblah" and it would return "/home/user/blahtyblahtyblahblah". In other words, if there was a file called blahtyblahtyblahblah in your current directory, that would be the path to it, it doesn't do any check to see if there actually is a file there with that name. If you want that, you'll need to use "readlink -e".

You said you put the image on an external hard drive. Where is that drive mounted? How do you get to it when you use the file browser? Go there in your file browser, find the file, and then look at the title bar of the file browser, it will tell you where you are. You could also run "df -h" to see all mounted filesystems, navigate to the one with the file, and use a combination of "cd", "ls", and "pwd" to find the file and get its full path.

Note: if it's on an external hard drive, it's not going to be in your home directory, it's going to be in something like "/run/media/user/1234ln123lkuigh123pj234lk/homebackup.img"

Last edited by suicidaleggroll; 02-27-2017 at 12:01 PM.
 
Old 02-27-2017, 01:24 PM   #11
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 4,362

Rep: Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001
Quote:
Originally Posted by GNewbie View Post
Hi rknichols, you don't have to believe the hard to believe. I know right were it is, but only in a sense. It is on a partition in my USB harddrive. I can navigate to it with no problem.

The problem I have is that I can't use a directory path that linux understands.
Precisely how do you "navigate to it"??
 
Old 03-03-2017, 10:43 AM   #12
GNewbie
Member
 
Registered: Sep 2005
Distribution: (U/K/X)buntu 6.1 (newer box) / D*mn Small Linux (older box)
Posts: 318

Original Poster
Rep: Reputation: 31
Quote:
Originally Posted by rknichols View Post
Precisely how do you "navigate to it"??
Hi rknichols, in Nemo, Mint's file manager system (GUI). I read the Linux101 section in my 15 year old Wrox book on Linux and found the "pwd" (present working directory) command, which enabled me to navigate via the GUI to the location of the file, open a terminal, and find the directory path expected by Linux.

Success! I was able to run testdisk on the image file. It didn't sense a type of partition. I manually chose the partition type that existed on the original partition that is currently not working (it was the EUFI option, IIRC). Please verify whether that choice was correct.

I went to the Geometry section and and I have my CHS value, but I don't know which of the four choices I should choose to enter it.

[ Cylinders ] [ Heads ] >[ Sectors ] [Sector Size] [ Ok ]

If I had to make an educated guess, I go to the "Heads" section and enter the CHS value based on the discussion in the paragraph previous to the listing of the four entry choices.

Is that right?

TIA...
 
Old 03-03-2017, 12:12 PM   #13
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 4,362

Rep: Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001
Was the image made of the whole disk (/dev/sda) or just partition 7 (/dev/sda7)? If it was just partition 7, then the partition table type for that image is "none", and that is why no partition table was detected. In that case, the CHS values don't matter.
 
Old 03-03-2017, 12:40 PM   #14
GNewbie
Member
 
Registered: Sep 2005
Distribution: (U/K/X)buntu 6.1 (newer box) / D*mn Small Linux (older box)
Posts: 318

Original Poster
Rep: Reputation: 31
Quote:
Originally Posted by rknichols View Post
Was the image made of the whole disk (/dev/sda) or just partition 7 (/dev/sda7)? If it was just partition 7, then the partition table type for that image is "none", and that is why no partition table was detected. In that case, the CHS values don't matter.
I only copied the home partition from the original drive to a USB drive. I did not image the whole drive. The USB with the partition-only image does have other files on it.

I'm reviewing Testdisk Steb-by-Step and came across this...

Code:
To recover partition from a media image or repair a filesystem image, run
testdisk image.dd to work from a raw disk image
Do I need to rename my hdbackup.img to something like hdbackup.dd? I did create the image with dd.

Also, do I want to begin by analyzing the partition and searching for backup superblocks? I believe missing superblocks were mentioned as a problem in the error message.

TIA...
 
Old 03-03-2017, 01:34 PM   #15
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 4,362

Rep: Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001Reputation: 2001
The name doesn't matter. Now that you know the path to the image file, just run testdisk on that file and select "none" (Non partitioned media) as the partition table type.

You could also just try running "fsck.ext4 /path/to/hdbackup.img". It should find the backup super blocks automatically. But, do NOT do this on your only copy of that image, especially not with the "-y" option. The job of fsck is to make the filesystem consistent. To do that, it will sometimes make otherwise recoverable data much harder to extract.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Drive Hard Crash kevinbenko Linux - Hardware 18 04-25-2016 10:26 AM
hard drive crash sandie1 Linux - Security 1 02-06-2011 09:13 PM
[SOLVED] Hardware crash,Repaired,New Install New Hard drive,how to access original Hard drive flatstan Linux - Hardware 7 07-21-2009 07:51 PM
HELP! Hard Drive crash Stew Pididiot Linux - Newbie 9 11-21-2005 06:45 AM
Hard Drive crash -- NEED HELP! Stew Pididiot Linux - General 2 10-28-2005 06:32 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 04:47 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration