linuxnoob

g'day all - i'm looking for help with an ext3 partition. i had a samba share running on oracle unbreakable linux and have lost the whole data partition.

i've tried testdisk but it doesn't seem to be able to recognise the filesystem

i've tried photo recover and retreived some data but not nearly the whole drive.

ditto on the vague results with fdisk.
[root@localhost ~]# fdisk -l /dev/sdb

Disk /dev/sdb: 320.0 GB, 320072933376 bytes
255 heads, 63 sectors/track, 38913 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

This doesn't look like a partition table
Probably you selected the wrong device.

Device Boot Start End Blocks Id System
/dev/sdb1 ? 188019 188051 253319 e4 SpeedStor
Partition 1 does not end on cylinder boundary.
/dev/sdb2 ? 62656 186401 993984023 98 Unknown
Partition 2 does not end on cylinder boundary.
/dev/sdb3 ? 105611 225119 959953209 7d Unknown
Partition 3 does not end on cylinder boundary.
/dev/sdb4 ? 959 1477 4161536 0 Empty
Partition 4 does not end on cylinder boundary.

Partition table entries are not in disk order

[root@localhost ~]# e2fsck -n /dev/sdb
e2fsck 1.40.2 (12-Jul-2007)
Couldn't find ext2 superblock, trying backup blocks...
e2fsck: Bad magic number in super-block while trying to open /dev/sdb

The superblock could not be read or does not describe a correct ext2
filesystem. If the device is valid and it really contains an ext2
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
e2fsck -b 8193 <device>

[root@localhost ~]#

[root@localhost ~]# mke2fs -n /dev/sdb
mke2fs 1.40.2 (12-Jul-2007)
/dev/sdb is entire device, not just one partition!
Proceed anyway? (y,n) n
[root@localhost ~]# mke2fs -n /dev/sdb1
mke2fs 1.40.2 (12-Jul-2007)
Could not stat /dev/sdb1 --- No such file or directory

The device apparently does not exist; did you specify it correctly?
[root@localhost ~]# mke2fs -n /dev/sdb
mke2fs 1.40.2 (12-Jul-2007)
/dev/sdb is entire device, not just one partition!
Proceed anyway? (y,n) y
Filesystem label=
OS type: Linux
Block size=4096 (log=2)
Fragment size=4096 (log=2)
39075840 inodes, 78142806 blocks
3907140 blocks (5.00%) reserved for the super user
First data block=0
Maximum filesystem blocks=0
2385 block groups
32768 blocks per group, 32768 fragments per group
16384 inodes per group
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
4096000, 7962624, 11239424, 20480000, 23887872, 71663616




i'd appreciate any assistance
noooob

wmorri

Hi,

Welcome to TSF!!

Let me ask you which partition on your sdb hdd is the one that is lost? Also, how do you know that it is lost. Is it just that you can't get to it on a file browsers or command? Are their files that you are missing is that how you know there is a problem?

Cheers!

Skie

You DO NOT want to run mke2fs at this point in time as it may destroy any chance of you recovering your data. The fewer changes you make to the hard drive/partition in question, the better chance you'll have of recovering your data.

The drive itself may be failing, which is most likely why you've run into this problem. When you ran testdisk, did you have it search deeper into the drive? The initial scan doesn't always find all the partitions. The first deep scan sometimes does. A second deep scan has never worked for me (the few times I've used it). However, keep in mind that the results/performance of testdisk depends on how badly damaged the drive is.

linuxnoob

Thanks Skie and wmorri for the fast response and welcome.

wmorri - i was using the drive as storage on my fileserver that was oracle linux, and for the most part accessing that from my xbmc xbox.

the drive was partitioned with one EXT3 partition for the whole 300gb

from memory (this actually happened a few months ago) the drive was mounted up working one night, then the next was unavailable. I logged onto the PC to investigate and found nothing in the folder it was mounted to.

i checked via fdisk and no partition could be found.

Skie - i ran testdisk and it couldn't detect the filesystem type, ran a deep scan which took forever, however i can't remember the result exactly.

i'll hook up the drive again and re-run test disk for results.

as i mentioned i ran photorec but didn't get great results

it's a relatively new drive so i'd be surprised if it was a physical issue, but then again i've been surprised by lots of things

thanks again for your interest...
noooob

linuxnoob

Hi Skie and wmorri

Testdisk results below

TestDisk 6.6, Data Recovery Utility, February 2007
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:
Partition Start End Size in sectors

1 * SpeedStor FAT16 ext 188018 149 36 188050 31 27 506638

Warning: Bad starting sector (CHS and LBA don't match)
2 * Sys=98 62655 150 49 186400 224 7 1987968046

Bad relative sector.
3 * Sys=7D 105610 17 55 225118 182 57 1919906418

Bad relative sector.
Only one partition must be bootable
Space conflict between the following two partitions
2 * Sys=98 62655 150 49 186400 224 7 1987968046
3 * Sys=7D 105610 17 55 225118 182 57 1919906418
Next
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
[Proceed ] [ Backup ]
Try to locate partition
======================================================


TestDisk 6.6, Data Recovery Utility, February 2007
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
Partition Start End Size in sectors
D Linux 0 1 1 38912 254 63 625137282
D HPFS - NTFS 0 1 1 38912 254 63 625137282

Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
NTFS found using backup sector!, 320 GB / 298 GiB
====================================================

TestDisk 6.6, Data Recovery Utility, February 2007
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

D Linux 0 1 1 38912 254 63 625137282
Use Right arrow to change directory, q to quit
Directory /

No file found, filesystem seems damaged.



thanks in advance if you can make anything of this
noooob

Skie

On the second half of the output, it shows the deleted EXT3 partition.

Are you able to select that option and recover it? If you can, the next thing you should do is mount the partiton and backup any important info. Then, run a "smartctl -t long /dev/sdb" on that drive. This may take a few hours, the command will tell you the approx time it will take. This will tell you the health status of the drive.

As far as it being a new drive, that means nothing. I've personally had a brand new hard drive that I bought just an hour earlier fail on me after only 2 or 3 boots. I was able to fdisk and format, but before I could install an OS it started clicking loudly and no longer seemed to be accessable by the computer. I just recently replaced a hard drive that failed in a server less then a year after I bought it. Sometimes you just get a bad one and it's only a matter of time before they go.

The worst for me was when 3 hard drives failed in one year. 2 of them failed about 4 days from each other (one was my main computer, the other was my laptop).

linuxnoob

Hi Skie

thanks again for your help :)

I'll certainly try to recovery the partition.
Just one question, as the documentation is not all that user friendly.

with the options at this stage being -

Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue


which one should i follow?

i'd be thinking that it was an extended partition in first place so maybe E.
or then it's the only partition so maybe it's P

from memory i think it was at a decision point like this i gave up last time for fear of losing everything forever.

Skie

The P, E, etc are just labels. If you look at the portion that I quoted, you'll see a "D" at the begining of both lines. This means that it found 2 deleted partitions on your drive, both of which are the same size and reside in the same exact location. I'm assuming that you had previously deleted an existing Windows partition to use for Linux.

What you should do is use the arrow keys to select the Linux partition, then hit Enter. From there you should be given futher options, possibly recover. I don't use testdisk often, so I don't remember everything right off the top of my head. I'm trying to help you as best as I can from what I remember.

linuxnoob

Hi Skie,

It seems all might be lost...

i wrote the partition to disk and tried to mount after required reboot only to receive

[root@localhost ~]# mount /dev/sdb1 /recover
mount: wrong fs type, bad option, bad superblock on /dev/sdb1,
missing codepage or other error
In some cases useful info is found in syslog - try
dmesg | tail or so

cat of messages
Feb 27 21:00:01 localhost kernel: EXT3-fs error (device sdb1): ext3_check_descriptors: Block bitmap for group 0 not in group (block 1174554113)!
Feb 27 21:00:01 localhost kernel: EXT3-fs: group descriptors corrupted!

i appreciate you assistance tho...

it's Australian local custom to buy someone who helps you out a beer
consider yourself as owed one....

noooob

Skie

I was afraid of that. The error "Warning: Bad starting sector" made me think the hard drive might be failing. I can't think of anything else that might help at this point.

wmorri

Skie,

Do you think that a ghost image of the hdd might help the OP. If he were to get a program from the hdd manufacturer and then make an image, and place it on the new hdd then he might be able to get a hold of the partition and bring it back?

I am having to do this with a current hdd that is too small and needs to be updated.

Cheers!

linuxnoob

Thanks Skie and wmorri

wmorri are you suggesting that testdisk might be able to repair the partition structure if the it's written to a fresh drive?

i'll be willing to have a crack at it. it a western digital. is there a specific utility for that vendor?

noooob (aka adam)

wmorri

Hi,

Yes that is what I am suggesting. I would need to know what model WD the hdd is. Then I can check and see if there is a utility for it. Skie, do you think that this would work?

Cheers!

Skie

I believe in theory, it should work. Although I've never tried something like this. It would depend on how badly damaged the hard drive is.

dd can also be used in place of Ghost, but I'm not sure if Ghost offers additional features. The last time I used it was back in 95 or 96.

linuxnoob

Thanks all,

I've had a busy couple of days (it's already Tuesday afternoon here in Oz) but i'll take out the drive and source another this evening.

Shouldn't be too had as the local computer store stock piles drives.

I'll let you know.
noooob

linuxnoob

Hi all,

it's a western digital WD 3200JS-60PDB0

i'll try and find one to purchase.

cheers
noooob

linuxnoob

Hi guys, i hope the last week has treated you well and you're relaxed after your weekends.

it took a bit but i found an ALMOST similar drive.

it's a WD3200AAKS. hopefully the only difference is the larger cache.

anyway, the original drive was a little older than i thought.

any thoughts??

and the guy at the computer shop suggested there was no specific WD utility that he knew of that could help, and therefore DD command would prolly be the best.

i'm ok with running it, at least i've used it for writing images to thumb drive to install from. the only issue i can foresee is knowing which is the IF and which is the OF.

i don't know how to tell which drive is which after having plugged them both at the same time, they'll both be /DEV/SDx.....

any pointers?

thanks heaps
nooooooob (feeling extra "ooooo" today)

Rome5

If I'm not mistaken, the current 'problem' drive is /dev/sdb, correct? So you already have two drives connected? If the new drive is connected next in line, it should be /dev/sdc. Device names are designated based on boot priority and physical connection (which is connected first in line, or for IDE, master and then slave). Before you do anything, run 'sudo fdisk -l' (lowercase L) to get a drive listing. You'll be able to tell which is which based on partitions since the new drive will be without.

linuxnoob

Thanks Rome5,

only problem is that both the drives are out at the moment and both a SATA, so there's no master/slave.

but i realised after that i could run ls -la /dev/sd* and it'd list all the drives and partitions found. I'm pretty sure that the "broken" drive has the partition showing from when test disk tried to recreate it.

nothing to do now but plug in and have a crack it.

cheers
nooob

linuxnoob

Hey Skie and wmorri,

I'm not sure if you're still checking this thread but i finally got around to dd-ing the image of broken drive onto new drive and i managed to recover all my photoes!!!!

I didn't recover all my data, but a surprising amount. Photos were priority one but i also recovered 30gig of tunes and several gig of other video.

The process itself was pretty messy, prolly the ugliest hack job in computer history. The dd took a while, infact i thought it had failed cause the process was still running after a full day + but the resources it was using had dropped right off. Not sure if there's a way to get a progress out of dd. I ended up killing the process.

i got the same error (mount: wrong FS type) trying to mount the new drive (SDD) as i did with the broken (SDC) (and log entry 'Group descriptors corrupted') but the partitions both showed up when i did an ls -la of /dev/sd*.

Testdisk was not all that helpful as it didn't manage to restore the partition, what ended up working in a messy sort of way was fsck. The damage to the partition was so bad that fsck wouldn't even run non-interactively so i had to basically hold my finger on the 'Y' key for 2 evenings while fsck did it's thing.

In the end it was not a hugely successful exercise in trying to recover the whole drive, and perhaps i was extraordinary lucky in managing to recover the only data that was critical (to me at least) but it did at least go a little way towards suggesting that your idea of copying the image onnto an identical drive was right and it's worth a try.

Now that i have my pics back (and the least of about 80gig of a total of 200 lost) i might retry the process to see if i can do it with a little more grace, and recover more data.


thanks heaps for you assistance
noooob