Hard Drive Rehab Effort after Crash

GNewbie · 02-24-2017, 12:03 PM

Hi All,

I have a hard drive I'm trying to rehabilitate after it crashed. Primarily, I want to try and get my Thunderbird files off of it, but it would be nice to get a few other files off of it as well.

I created an image on a new hard drive and I've copied the image to a third hard drive.

One option is to try and testdisk on the image, but the tutorials I've found focus on running testdisk on the partition, not on an image file within a partition. If anyone is aware of an online tool that discusses running testdisk against an image on a partition, I would appreciate posting a link to this thread.

As it stands now, I have the non-compliant hard drive attached as a USB device to my computer (with another hard drive).

sda7 is the corrupted home partition. I've been told the problem is likely a disk error. The partitions on the drive don't automatically mount. When I try to manually mount sda7, I get the following output:

Code:

~ $ sudo mount -t ext4 /dev/sda7 /mnt/homebu
mount: wrong fs type, bad option, bad superblock on /dev/sda7,
       missing codepage or helper program, or other error

       In some cases useful info is found in syslog - try
       dmesg | tail or so.

BTW, I'm pretty sure the file type is ext4. Just in case, I ran the same command with ext3 and received the same result.

Can anyone share any troubleshooting advice?

TIA...

Edited to add: what is the nomenclature to run a linux command against an image on a partition, as opposed to the partition itself?

rknichols · 02-24-2017, 12:18 PM

You can run testdisk on an image file. You will need to include the file name on the command line, and you should go to the "Geometry" menu and set the parameters to match what was in use for the original disk. testdisk remains wedded to C/H/S geometry, and can behave strangely if the geometry doesn't match the way the partitioning was originally set up.

SilentSam · 02-24-2017, 12:18 PM

First off, confirm the FS type:

Code:

sudo parted -l

Or use gparted, which is an excellent tool.

Mounting an image depends on how you generated it. I'm assuming you used dd to create your image here. Images need to be mounted as loop devices, so

Code:

sudo mount /path/to/image.img /mnt/folder -o loop

Most distros ship mount that can autodetect the filesystem in the image. You can obviously specify the filesystem type using -t should the autodetection fail.

GNewbie · 02-24-2017, 01:19 PM

Hi All, thanks for the input.

I followed the instructions in this video on the actual drive itself (not the copied image)...

Test Disk - How to Recover Files from a Faulty Hard-Drive
https://www.youtube.com/watch?v=Exq-aWBmRyI

...and I ended up with the following error when I tried to access sda7 (my damaged home drive location):

Code:

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

 7 L Linux                 4802  96 31 114221   8 27 1757810688

Can't open filesystem. Filesystem seems damaged.

>[  Quit  ]
                               Quit this section

re: SilentSam

It is ext4. Here is the output of "sudo parted -l"

Code:

Model: WDC WD10 EZEX-00RKKA0 (scsi)
Disk /dev/sdd: 1000GB
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Disk Flags: 

Number  Start   End     Size    Type      File system  Flags
 1      1049kB  500MB   499MB   primary   ext4         boot
 2      501MB   939GB   939GB   extended
 5      501MB   15.5GB  15.0GB  logical   ext4
 6      15.5GB  39.5GB  24.0GB  logical
 7      39.5GB  939GB   900GB   logical   ext4

I will try and mount the image using the method you recommend. Once it is mounted, will testdisk pick it up as a partition? Also, given that testdisk can't read the original hard drive partition, it looks like I won't be able to recover files from the drive, rather, I'll need to focus on trying to rehabilitate the partition.

re: rknichols

>>You can run testdisk on an image file. You will need to include the file name on the command line,<<

You mean like

Code:

testdisk /dev/sdc3/homebackup.img

Do I need any sort of flag? Can you post a link to an example? I'm brand new at this, but I realize the world of hurt I can create if I make a wrong move out of nescience.

>>and you should go to the "Geometry" menu and set the parameters to match what was in use for the original disk. testdisk remains wedded to C/H/S geometry, and can behave strangely if the geometry doesn't match the way the partitioning was originally set up.<<

I presume you refer to the "Geometry" option in the listing that lists "Analyse" and "Advanced" above "Geometry."

Does the image itself retain the hd parameters, or do I need to get those parameters from the original hard drive? By "parameters," do you mean the start and stop location of the partition? I believe I can used fdisk on the original drive to get those values. I also presume that testdisk provides a place to enter these values after selecting "Geometry."

SilentSam · 02-24-2017, 03:41 PM

Quote:

Originally Posted by GNewbie

Code:

testdisk /dev/sdc3/homebackup.img

Do I need any sort of flag? Can you post a link to an example? I'm brand new at this, but I realize the world of hurt I can create if I make a wrong move out of nescience.

>>and you should go to the "Geometry" menu and set the parameters to match what was in use for the original disk. testdisk remains wedded to C/H/S geometry, and can behave strangely if the geometry doesn't match the way the partitioning was originally set up.<<

I presume you refer to the "Geometry" option in the listing that lists "Analyse" and "Advanced" above "Geometry."

Does the image itself retain the hd parameters, or do I need to get those parameters from the original hard drive? By "parameters," do you mean the start and stop location of the partition? I believe I can used fdisk on the original drive to get those values. I also presume that testdisk provides a place to enter these values after selecting "Geometry."

Code:

silentsam@lq:~$ sudo testdisk /list /dev/sdb1
[sudo] password for silentsam: 
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Please wait...
Disk /dev/sdb1 - 1998 MB / 1905 MiB - CHS 1015 62 62
Sector size:512
Model: Kingston DataTraveler 2.0, FW:PMAP

Disk /dev/sdb1 - 1998 MB / 1905 MiB - CHS 1015 62 62
     Partition			Start        End    Size in sectors
   P FAT32                    0   0  1  1015  29 29    3903487 [SYSRESC]
     FAT32, blocksize=4096

Or, if the image was the entire disk:

Code:

silentsam@lq:~$ sudo testdisk /list /dev/sdb
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Please wait...
Disk /dev/sdb - 1998 MB / 1906 MiB - CHS 1015 62 62
Sector size:512
Model: Kingston DataTraveler 2.0, FW:PMAP

Disk /dev/sdb - 1998 MB / 1906 MiB - CHS 1015 62 62
     Partition			Start        End    Size in sectors
 1 * FAT32 LBA                0   0  2  1015  29 30    3903487 [SYSRESC]
     FAT32, blocksize=4096

It's the value CHS 1015 62 62 that would need to be correct. You can retrieve the proper values directly from the disk much like I did. If I took an image of this drive, I would need to ensure that in Geometry it's set up correctly in TestDisk when accessing the image.

edit:

Code:

testdisk /dev/sdc3/homebackup.img

Wouldn't work. You need to point to the actual path... ie:

Code:

sudo testdisk /home/user/homebackup.img

or something similar.

rknichols · 02-24-2017, 04:11 PM

Quote:

Originally Posted by GNewbie

re: rknichols

>>You can run testdisk on an image file. You will need to include the file name on the command line,<<

You mean like

Code:

testdisk /dev/sdc3/homebackup.img

Do I need any sort of flag? Can you post a link to an example? I'm brand new at this, but I realize the world of hurt I can create if I make a wrong move out of nescience.

That's all you need. testdisk will come up offering that file as the only "device" option.

testdisk won't write anything to the file or device unless you tell it to. If you're rebuilding the partition table, you have to tell it to write out the new table. If you're recovering files, you have to tell it where to put them.

GNewbie · 02-26-2017, 01:46 PM

Hi SilentSam and rknichols,

I followed the instructions below and was able to retrieve the CHS value without a problem.

However, I'm having a problem when it comes to pointing testdisk to the homebackup.img file.

I couldn't figure out the directory path, so I did some searching and used the following to retrieve what I thought would be the directory path.

Code:

readlink -f file.txt

It returned...

Code:

/home/user/homebackup.img

When I directed testdisk towards the image, I received the following error message...

Code:

user@user-desktop ~ $ sudo testdisk /home/user/homebackup.img
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Unable to open file or device /home/user/homebackup.img: No such file or directory
user@user-desktop ~ $

Do you have any ideas as to how I can proceed?

TIA...

Quote:

Originally Posted by SilentSam

Code:

silentsam@lq:~$ sudo testdisk /list /dev/sdb1
[sudo] password for silentsam: 
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Please wait...
Disk /dev/sdb1 - 1998 MB / 1905 MiB - CHS 1015 62 62
Sector size:512
Model: Kingston DataTraveler 2.0, FW:PMAP

Disk /dev/sdb1 - 1998 MB / 1905 MiB - CHS 1015 62 62
     Partition			Start        End    Size in sectors
   P FAT32                    0   0  1  1015  29 29    3903487 [SYSRESC]
     FAT32, blocksize=4096

Or, if the image was the entire disk:

Code:

silentsam@lq:~$ sudo testdisk /list /dev/sdb
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Please wait...
Disk /dev/sdb - 1998 MB / 1906 MiB - CHS 1015 62 62
Sector size:512
Model: Kingston DataTraveler 2.0, FW:PMAP

Disk /dev/sdb - 1998 MB / 1906 MiB - CHS 1015 62 62
     Partition			Start        End    Size in sectors
 1 * FAT32 LBA                0   0  2  1015  29 30    3903487 [SYSRESC]
     FAT32, blocksize=4096

It's the value CHS 1015 62 62 that would need to be correct. You can retrieve the proper values directly from the disk much like I did. If I took an image of this drive, I would need to ensure that in Geometry it's set up correctly in TestDisk when accessing the image.

edit:

Code:

testdisk /dev/sdc3/homebackup.img

Wouldn't work. You need to point to the actual path... ie:

Code:

sudo testdisk /home/user/homebackup.img

or something similar.

rknichols · 02-26-2017, 05:17 PM

I find it hard to believe you could go to all the effort of making an image file and not know where you put it. Earlier, you said,

Quote:

Originally Posted by GNewbie

I created an image on a new hard drive and I've copied the image to a third hard drive.

Are either of those images ordinary files, or did you just make each of those two drives an image of the original? Did you even create a file named "homebackup.img"? It's also not apparent how a symbolic link with the unlikely name of "file.txt" was created with a target of "/home/user/homebackup.img". Note that you can create a symbolic link with any arbitrary text as the "target". It doesn't have to point to anything that exists.

Just how did you create and copy those images, and what created that "file.txt" link?

GNewbie · 02-27-2017, 10:24 AM

Quote:

Originally Posted by rknichols

I find it hard to believe you could go to all the effort of making an image file and not know where you put it. Earlier, you said,
Are either of those images ordinary files, or did you just make each of those two drives an image of the original? Did you even create a file named "homebackup.img"? It's also not apparent how a symbolic link with the unlikely name of "file.txt" was created with a target of "/home/user/homebackup.img". Note that you can create a symbolic link with any arbitrary text as the "target". It doesn't have to point to anything that exists.

Just how did you create and copy those images, and what created that "file.txt" link?

Hi rknichols, you don't have to believe the hard to believe. I know right were it is, but only in a sense. It is on a partition in my USB harddrive. I can navigate to it with no problem.

The problem I have is that I can't use a directory path that linux understands.

My apologies. I copied the tutorial example and not what I actually input - my mistake.

I actually typed this (sorry for the confusion):

Code:

readlink -f homebackup.img

I used dd to created the images.

So, before causing the confusion, I'm left with the readlink program yielding the following as my path:

Code:

/home/user/homebackup.img

But the following command line input doesn't work because linux doesn't see the image file:

Code:

testdisk /home/user/homebackup.img

I must be confused regarding the directory path that linux expects as input in order to point at homebackup.img.

How do I nail down that path since readlink apparently didn't do it?

TIA and sorry about the confusion caused when I didn't update the file name of the example I used to do my own readlink search.

suicidaleggroll · 02-27-2017, 10:50 AM

Ignore readlink, that's used for following symbolic links, which you don't have. All it's telling you is your current location, it's not telling you anything about any actual file that exists on the system. You could run "readlink -f blahtyblahtyblahblah" and it would return "/home/user/blahtyblahtyblahblah". In other words, if there was a file called blahtyblahtyblahblah in your current directory, that would be the path to it, it doesn't do any check to see if there actually is a file there with that name. If you want that, you'll need to use "readlink -e".

You said you put the image on an external hard drive. Where is that drive mounted? How do you get to it when you use the file browser? Go there in your file browser, find the file, and then look at the title bar of the file browser, it will tell you where you are. You could also run "df -h" to see all mounted filesystems, navigate to the one with the file, and use a combination of "cd", "ls", and "pwd" to find the file and get its full path.

Note: if it's on an external hard drive, it's not going to be in your home directory, it's going to be in something like "/run/media/user/1234ln123lkuigh123pj234lk/homebackup.img"

rknichols · 02-27-2017, 12:24 PM

Quote:

Originally Posted by GNewbie

Hi rknichols, you don't have to believe the hard to believe. I know right were it is, but only in a sense. It is on a partition in my USB harddrive. I can navigate to it with no problem.

The problem I have is that I can't use a directory path that linux understands.

Precisely how do you "navigate to it"??

GNewbie · 03-03-2017, 09:43 AM

Quote:

Originally Posted by rknichols

Precisely how do you "navigate to it"??

Hi rknichols, in Nemo, Mint's file manager system (GUI). I read the Linux101 section in my 15 year old Wrox book on Linux and found the "pwd" (present working directory) command, which enabled me to navigate via the GUI to the location of the file, open a terminal, and find the directory path expected by Linux.

Success! I was able to run testdisk on the image file. It didn't sense a type of partition. I manually chose the partition type that existed on the original partition that is currently not working (it was the EUFI option, IIRC). Please verify whether that choice was correct.

I went to the Geometry section and and I have my CHS value, but I don't know which of the four choices I should choose to enter it.

[ Cylinders ] [ Heads ] >[ Sectors ] [Sector Size] [ Ok ]

If I had to make an educated guess, I go to the "Heads" section and enter the CHS value based on the discussion in the paragraph previous to the listing of the four entry choices.

Is that right?

TIA...

rknichols · 03-03-2017, 11:12 AM

Was the image made of the whole disk (/dev/sda) or just partition 7 (/dev/sda7)? If it was just partition 7, then the partition table type for that image is "none", and that is why no partition table was detected. In that case, the CHS values don't matter.

GNewbie · 03-03-2017, 11:40 AM

Quote:

Originally Posted by rknichols

Was the image made of the whole disk (/dev/sda) or just partition 7 (/dev/sda7)? If it was just partition 7, then the partition table type for that image is "none", and that is why no partition table was detected. In that case, the CHS values don't matter.

I only copied the home partition from the original drive to a USB drive. I did not image the whole drive. The USB with the partition-only image does have other files on it.

I'm reviewing Testdisk Steb-by-Step and came across this...

Code:

To recover partition from a media image or repair a filesystem image, run
testdisk image.dd to work from a raw disk image

Do I need to rename my hdbackup.img to something like hdbackup.dd? I did create the image with dd.

Also, do I want to begin by analyzing the partition and searching for backup superblocks? I believe missing superblocks were mentioned as a problem in the error message.

TIA...

rknichols · 03-03-2017, 12:34 PM

The name doesn't matter. Now that you know the path to the image file, just run testdisk on that file and select "none" (Non partitioned media) as the partition table type.

You could also just try running "fsck.ext4 /path/to/hdbackup.img". It should find the backup super blocks automatically. But, do NOT do this on your only copy of that image, especially not with the "-y" option. The job of fsck is to make the filesystem consistent. To do that, it will sometimes make otherwise recoverable data much harder to extract.