KNOPPIX to the Rescue - mounting the HDD
 

Hey, all. I'm running Fedora Core 3, and I cannot log in for some strange reason, and whether or not I can fix it may require me to abandon my data and start from scratch. Either way here's the question.

I have a copy of Knoppix 4.0, that I have booted and therefore can get to this wonderful repository called the internet. I wanted to back up my data before I proceeded any further just in case (plus, I think part of my problem is that the HDD is too full).

Knoppix only sees two HDD devices, the primary (Hda1) and the Linux Swap partition (Hda2). Fine. But on Hda1, there's only the boot folder, and the compressed kernel stuff. I can't find any of the file structure. Is there a special mounting procedure for it?

Thanks,
Cerberus

I have been using Knoppix for some time. Knoppix places icons for each valid partition it can 'see' on the desktop. All I have found necessary is to click on an icon, and it mounts the partition.

If you are missing partitions, or disk drives, I would guess something ugly has happened.

I don't have 4.0, but most versions I have used have Q-parted. You could bring it up and see if it can 'see' any of your missing stuff.

Do you see any messages about partitions when booting Fedora that would indicate something is wrong? If so, what errors.

There are a couple of error messages that occur through normal fedora boot, but I can never catch them on their way by. I think this thread describes my problem the best,

showthread.php?t=469658

and I think the solution is there, but I can't get to the contents of the drive. I can only see the boot and kernel files on the partition.

Now that I think about it, Hda2 might be my user files, and it may not have displayed the swap partition. I just assumed since it claimed Hda2 was 'not a valid partition' that it was the swap. Hrm. The need for more eploration is definitely apparent.

Thanks,
Cerberus.

The plot thickens
 

So, as I said, further exploration was required, so I opened QTParted, and it tells me that hda1 is ext3 100mb, boot partition.

Cool. Answers that mystery.

hda2 is of unknown format, 38.19GB. Bingo. There's my user data. But since it's of an unknown format, knoppix isn't dumb enough to mount it anyways. I suppose I'm glad it's not. But...

What does it mean uknown format? I had formatted it as ext3 when I built this machine back in february. Has part of my partition table gotten lost? I know a number of bizarre power interruptions have plagued my household (I've been through five surge master power strips in the last year...), but I wouldn't think the partition table would be that fragile.

Further, is any of the data salvageable? Since it reports the size properly, I'm assuming the bits and bytes are still there, but how can I find it if the partition type cannot be determined?

Thanks again,
Cerberus.

I think there is a good chance to salvage the data. Exactly what has happened woudl be very difficult to determine. You coud have bad blocks, a bad partition table, who knows. The thing to do now is try and recover what you can. I have never had to recover a messed up partition, so I did some looking around, and there are command line tools to help out.

I'm not sure this is the best, or only tool, but start here:

http://wiki.linuxquestions.org/wiki/E2fsck

It looks like e2fsck may do the job. There is a man page also. It works with Ext2 and Ext3 partitions that are not mounted. You won't recover anything until we can mount the partition.

Hope this helps.

I just had a batch of powerouts and problems and one of my FAT32 partitions showed the same thing. Unknown format etc, under Windows and Linux both. I used Testdisk, Google it for info, and used it rewrite my boot record and all is well. Testdisk has some good scanning and checking features, just a little confusing to run. Pretty good info on their site on howto recover your boot record. An fdisk -l /dev/hd? showed all the partitions just one as unknown.

Bad SuperBlock
 

Okay, so I tried the e2fsck, and it tells me a variety of things, mostly that I have a bad superblock.

What is a superblock, and how can one be bad? The man page for e2fsck says I have spares every so many blocks, but how do I use one of those to fix the bad one? If it's so smart, why didn't it do it itself?

Sorry for the philosophical breakdown. I'm going to try another couple of diskutils, and report back, but if anyone knows anything about superblocks....

~:scratch:
Cerberus.

Here is a link to tell you what a superblock is.

http://www.science.unitn.it/~fiorell...lk/node97.html

I'm doing some research on how to fix it.

I'll post back.

When else fails, read man page.
 

So, I've been digging, too, and it appears that using the -b switch for e2fsck will update the primary superblock with one of the backup copies automatically, IF you know where to find one. Apparently mke2fs can tell you, but I haven't read up on that yet.

If I understand this correctly, I need to run mke2fs with a -n swtich to tell me the location of backup superblocks. Then I need to run e2fsck with the -b switch and the address of the backup superblock, and then the weapon against evil should work?

"Theoretically?"
"You've never seen this thing work before have you?"

*sigh* I think I'm going to need another beer before I have the courage to do this.

~:study:
Cerberus

B.S. Thanks so much for all your help, Cliff. This is the first problem I haven't had the nutz to muddle through myself. I think the thought of losing the first, second, and most of the third fiscal quater's worth of data because it moves too fast to back up drove me into idiot mode.

No functioning backups...
 

So I ran mke2fs -n /dev/hda2 to find some superblocks. I was surprised when it spit out eleven separate backup addresses. But with every SB I tried, I got the same message.

root@0[~]# e2fsck -b 32768 -f /dev/hda2
e2fsck 1.38 (30-Jun-2005)
e2fsck: Bad magic number in super-block while trying to open /dev/hda2

The superblock could not be read or does not describe a correct ext2
filesystem. If the device is valid and it really contains an ext2
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
e2fsck -b 8193 <device>

Two calls for this, either all of my SBs are corrupt, or mke2fs guessed a different block size than Fedora's kernel mke2fs did when it wrote the thing...

I've heard of a last ditch effort to save it that involves using mke2fs -S which only rewrites the Superblock and group descriptors only, but if the wrong block size is specified, it's totally hosed.

So I guess I need a better way to find SBs.

Anything on finding them?

~:study: :scratch: :study:
Cerberus

Post #6, testdisk.

Giving Up.
 

So, after wroking with testdisk for two days trying to figure out how the hell it's supposed to help me, I'm seriously considering abandoning the drive.

I ran a bunch of scans, and after fiddling with the geometry settings a dozen times: my drive doesn't have CHS written on it, the manufacturer's data sheet was wrong, my bios was wrong, in fact, there was no pleasing testdisk. Everytime I tried to run it, it told me that the CHS and LBA didn't match, until I got out a calculator, and calculated out what the CHS had to be in order for it to get it right. At that point, I scanned the drive, and it found my old NTFS partition that I deleted back in february when I formatted the entire drive with ext formats.

Either way, it never found the partition, and I didn't see a way to write any partition that it found anyways, and it would only tell me superblock locations for the /boot partition, and not the rest of the drive.

Other than imaging it and getting out the forensic tools (which I don't have the time or money for), I'm quickly considering giving up on this drive and it's contents.:cry:

Data loss was so much easier to cope with when we used GatesWare, it would pop up a nice dialog box that said "You're Screwed: Welcome to Square One."

But Linux has always been so accomodating with fixes and tweaks I never thought possible.

~Thanks Anyways
Cerberus.

I suspect you are dealing with failed hardware, that is a lot different that some messed up sectors on the disk. The tools will fix thoes. All is not lost, you now know more about this than most of us. I would bet your backup in the future will be much better than the past.