Need help recovering lost partitions

Need help recovering lost partitions

[dan]

I have a hard drive which had about 5 ReiserFs 3.6
logical partitions on it until last night.  After
booting up my computer (running Mandrake 9.2) I got
some error messages saying that it needed to fsck the
drive.  It went in a loop for quite a bit of time --
fscking all the partitions and then rebooting, finding
errors again, and rebooting.  I figured out how to get
in manually, and tried backing up my data.  In the
process though my partition table was lost.  (I tried
deleting an ext2 partition I didn't need using fdisk
and when I wrote teh new partition table to disk the
partition was empty).

At some point I decided that enough is enough and
installed Mandrake on another hard drive, and tried
finding partitions using parted and gpart.  Neither
utility managed to detect my partitions.

So I took a big jump.  I put one giant partition on the
hard drive (ReiserFS) and ran reiserfsck --rebuild-tree
-scan-whole-partition.

I was overjoyed to find that the files were there --
6,000+ files and numberous directoies were found. 
However, every file I opened was either filled with
nulls or gobblygook.  

I know the data is on the drive.  However reiserfsck
found them proves this.  However, I figured that
(perhaps) the --rebuild-tree is reading all files from
the start of the giant partition.

How can I go about recovering my data?

Many many thanks in advance,

-Dan


Dan Anderson
Manager
nGen, LLC.
Phone: (914) 466-8526
Fax: (775)562-2622
Email: dan@ngenllc.com

Re: Need help recovering lost partitions

[Matt Stegman]

You know, I think that unless you remember the original partition
boundaries, it may be too late now.  I'm sure the reason your files
don't have the right data is that all your data block numbers are
scrambled.

See, when you created one big partition, that means that, for example, the
data block #45 from /dev/hda2 is now block #23456 in your all-disk
/dev/hda1.  Another data block #45 from /dev/hda3 could be now block
#67890 (or whatever; I'm just throwing out numbers to make a point).
Fsck wouldn't know how to translate block numbers from old partitions to
new ones.

So you have some file from /dev/hda2 that has data in block #45.  Fsck
picks this up, and recreates the tree, except that block #45 is not the
same block that inode meant.

If you haven't overwritten the superblocks (or whatever you call the first
block in the filesystem, the one that contains the magic that ideally
parted should have been able to find and key off of) then you could figure
out where your partitions began.  Then recreate those partitions, and try
"--rebuild-tree --scan-whole-partition" again to rebuild the metadata.

If those have been overwritten, then I think you're fscked (pun
intentional).  Nevermind that if fsck found two or more files with the
same apparent block numbers (from two different partitions) it probably
would have "corrected" the duplicates (copying that block to an apparently
free block and relocating the duplicate inode), and you may have no chance
to get those files back at all.  Besides looking at the raw disk blocks
yourself, that is ("strings /dev/hda" to retrieve text files, or something
similar).

Of course, I'm assuming some things I'm not sure about in how Reiserfs
handles metadata.

-- 
Matt Stegman



On Wed, 28 Jan 2004 dan@ngenllc.com wrote:

> I have a hard drive which had about 5 ReiserFs 3.6
> logical partitions on it until last night.  After
> booting up my computer (running Mandrake 9.2) I got
> some error messages saying that it needed to fsck the
> drive.  It went in a loop for quite a bit of time --
> fscking all the partitions and then rebooting, finding
> errors again, and rebooting.  I figured out how to get
> in manually, and tried backing up my data.  In the
> process though my partition table was lost.  (I tried
> deleting an ext2 partition I didn't need using fdisk
> and when I wrote teh new partition table to disk the
> partition was empty).
>
> At some point I decided that enough is enough and
> installed Mandrake on another hard drive, and tried
> finding partitions using parted and gpart.  Neither
> utility managed to detect my partitions.
>
> So I took a big jump.  I put one giant partition on the
> hard drive (ReiserFS) and ran reiserfsck --rebuild-tree
> -scan-whole-partition.
>
> I was overjoyed to find that the files were there --
> 6,000+ files and numberous directoies were found.
> However, every file I opened was either filled with
> nulls or gobblygook.
>
> I know the data is on the drive.  However reiserfsck
> found them proves this.  However, I figured that
> (perhaps) the --rebuild-tree is reading all files from
> the start of the giant partition.
>
> How can I go about recovering my data?
>
> Many many thanks in advance,
>
> -Dan

Re: Need help recovering lost partitions

[Phil Frost]

It's unlikely you will be able to do anything before you restore your
partition table. To do that, there exist utilities that scan the drive
for patterns that imply a filesystem was there at some time. I suggest
gpart, but there are many others.

It's likely that trying to rebuild the filesystem as one huge FS did
more harm than good. If you have a backup image of the drive, use that;
if you don't make one before you do anything with dd, such as
'dd if=/dev/hdX of=backup_image'. Then you can do all sorts of
diagnostics on the image, and you can copy it before you make any
changes, and eventually restore it to the drive, by using dd again,
should you be able to recover your data.

On Wed, Jan 28, 2004 at 03:35:28PM -0500, dan@ngenllc.com wrote:
> I have a hard drive which had about 5 ReiserFs 3.6
> logical partitions on it until last night.  After
> booting up my computer (running Mandrake 9.2) I got
> some error messages saying that it needed to fsck the
> drive.  It went in a loop for quite a bit of time --
> fscking all the partitions and then rebooting, finding
> errors again, and rebooting.  I figured out how to get
> in manually, and tried backing up my data.  In the
> process though my partition table was lost.  (I tried
> deleting an ext2 partition I didn't need using fdisk
> and when I wrote teh new partition table to disk the
> partition was empty).
> 
> At some point I decided that enough is enough and
> installed Mandrake on another hard drive, and tried
> finding partitions using parted and gpart.  Neither
> utility managed to detect my partitions.
> 
> So I took a big jump.  I put one giant partition on the
> hard drive (ReiserFS) and ran reiserfsck --rebuild-tree
> -scan-whole-partition.
> 
> I was overjoyed to find that the files were there --
> 6,000+ files and numberous directoies were found. 
> However, every file I opened was either filled with
> nulls or gobblygook.  
> 
> I know the data is on the drive.  However reiserfsck
> found them proves this.  However, I figured that
> (perhaps) the --rebuild-tree is reading all files from
> the start of the giant partition.
> 
> How can I go about recovering my data?
> 
> Many many thanks in advance,
> 
> -Dan
> 
> 
> 
> Dan Anderson
> Manager
> nGen, LLC.
> Phone: (914) 466-8526
> Fax: (775)562-2622
> Email: dan@ngenllc.com

Re: Need help recovering lost partitions

[dan]

On Wed, 28 Jan 2004 16:10:48 -0600 (CST), Matt Stegman
wrote:

> 
> You know, I think that unless you remember the
original
> partition
> boundaries, it may be too late now.  I'm sure the
> reason your files
> don't have the right data is that all your data block
> numbers are
> scrambled.
> 
> See, when you created one big partition, that means
> that, for example, the
> data block #45 from /dev/hda2 is now block #23456 in
> your all-disk
> /dev/hda1.  Another data block #45 from /dev/hda3
could
> be now block
> #67890 (or whatever; I'm just throwing out numbers to
> make a point).
> Fsck wouldn't know how to translate block numbers from
> old partitions to
> new ones.
> 
> So you have some file from /dev/hda2 that has data in
> block #45.  Fsck
> picks this up, and recreates the tree, except that
> block #45 is not the
> same block that inode meant.
> 
> If you haven't overwritten the superblocks (or
whatever
> you call the first
> block in the filesystem, the one that contains the
> magic that ideally


So how can I scan the partition for the old
superblocks?  gpart and parted weren't picking them up,
but I know they were there.  And the 6GB of data it
found is much less then the size of the partition
(50GB), which makes me think that some data might still
be there (i.e. only 100 * (6/50) % of the data could
have been overwritten).

-Dan


Dan Anderson
Manager
nGen, LLC.
Phone: (914) 466-8526
Fax: (775)562-2622
Email: dan@ngenllc.com

Re: Need help recovering lost partitions

[Matt Stegman]

Hmmm.

It seems that mkreiserfs leaves the first 64kB of the partition blank.
The magic is "ReIsEr2Fs", and it is bytes 53 - 61 in the 17th block (the
filesystem blocksize being 4kB).

I imagine there's a GUID in the superblock you could also look at, but
I'll have to go looking for the format.  This is just gleaned from
`od -c /dev/hda1`.

So the quickly written, but slowly executed way to find this is
(nnn is the number of 4kB blocks your disk has):

for n in `seq 0 nnn`; do
  magic=`dd if=/dev/hda bs=1 skip=$((4096 * $n + 52)) count=9 2>/dev/null`
  if [ "$magic" == "ReIsEr2Fs" ]; then
    echo Block $n \(sector $(($n * 8))\) is Reiserfs magic block
  fi
done

If you're good with C, you could probably whip up a single program to do
this which will work much faster (doesn't have the overhead of starting
new processes to read each block).

Now each of the listed sectors in the output (minus 64kB; remember the
blank spot) could be a starting sector for the filesystem.  You should
have some idea how big your partitions were; do some math to figure out if
any numbers are unlikely to be the right blocks.

This isn't a complete answer for your problem.  I may have skipped
over some things that I assume you know already.  And, of course, I may
just be wrong.

And never underestimate which blocks may have been overwritten.  Even if
you do manage to locate and recreate all your old partitions, you may not
be able to get any data back.  And as Phil said, you should work from a
backup; if at all possible, STOP WRITING TO THE ORIGINAL DISK.

There may even be data recovery places who do this sort of thing
professionally.

-- 
Matt Stegman



On Wed, 28 Jan 2004 dan@ngenllc.com wrote:

> So how can I scan the partition for the old
> superblocks?  gpart and parted weren't picking them up,
> but I know they were there.  And the 6GB of data it
> found is much less then the size of the partition
> (50GB), which makes me think that some data might still
> be there (i.e. only 100 * (6/50) % of the data could
> have been overwritten).
>
> -Dan

Re: Need help recovering lost partitions

[Carl-Daniel Hailfinger]

dan@ngenllc.com wrote:

> So how can I scan the partition for the old
> superblocks?  gpart and parted weren't picking them up,
> but I know they were there.  And the 6GB of data it
> found is much less then the size of the partition
> (50GB), which makes me think that some data might still
> be there (i.e. only 100 * (6/50) % of the data could
> have been overwritten).

If you did reiserfsck --rebuild-tree --scan-whole-partition on the
unpartitioned hard drive, it is very likely that this reduced your chance
of rescueing some data to zero.

It all depends on how much money you're willing to spend. For starters, I
would recommend you to try the support offered by Namesys. Since they
wrote reiserfs they should have the best chance rescuing you data if it is
still on disk. If the data has already been overwritten by your actions,
you could try some data rescure company who claim to restore overwritten
data with a scanning tunneling microscope or somesuch.

The namesys support has helped a colleague of mine to restore all of his
data albeit some filenames were lost. The files themselves were
uncorrupted. And another big advantage of namesys is that they charge only
about 1/10th of the amount a commercial data rescue company would bill
you. (based on quotes from the web sites of the respective companies)


HTH,
Carl-Daniel