If you happen to be near Coventry in the UK on Tuesday evening, the local Linux User Group is having a data recovery specialist/police forensics consultant do a presentation on recovery techniques, using Linux.
Email me off list for details. Regards, Ian > >From: William Shu <[email protected]> >To: [email protected] >Cc: [email protected] >Sent: Saturday, 17 October, 2009 21:24:21 >Subject: How can I access a possibly corrupted hard drive > > >Hi, >I suddenly could not boot from my Western Digital hard drive connected through >a SATA PCI card. I was told the drive is 'seen' in the hardware and that my >problem is in the operating system problem (software), which the tecnician >cannot handle. > >booting with a scientific linux 5.3 livedvd, I have tried to use fdisk to list >and fsck to correct the errors but to no avail. tried gparted which seems to >suggest disk is not formatted, and testdisk ends up with IO read errors. The >drive was formatted for logical volume management (LVM), but it does not even >appear when I click System->Adminstration->Logical Volume Management. from the >desktop > >Is there anyone who can suggest what could be wrong, what I could do to >correct this problem, or at least get back my data? > >Details of outputs from commands below. > >Many > thanks, > >William. > >------------------------[ fdisk and fsck outputs ]------------------------- > >[r...@slinux sluser]# uname -a >Linux slinux 2.6.18-128.1.1.el5 #1 SMP Tue Feb 10 11:42:49 EST 2009 i686 i686 >i386 GNU/Linux >[r...@slinux sluser]# >[r...@slinux sluser]# /sbin/fdisk -l > >Disk /dev/hda: 81.9 GB, 81964302336 bytes >255 heads, 63 sectors/track, 9964 cylinders >Units = cylinders of 16065 * 512 = 8225280 bytes > > Device Boot Start End Blocks Id System >/dev/hda1 * 1 637 5116671 b W95 FAT32 >/dev/hda2 > 638 9963 74911095 f W95 Ext'd (LBA) >/dev/hda5 651 1415 6144831 b W95 FAT32 >/dev/hda6 9243 9499 2064321 c W95 FAT32 (LBA) >/dev/hda7 638 650 104359+ 83 Linux >/dev/hda8 1416 9242 62870346 8e Linux LVM > >Unable to read /dev/sda >[r...@slinux > sluser]# /sbin/fsck -s /dev/sda{2,3,5,6,7} -ap >fsck 1.39 (29-May-2006) >fsck.ext2: No such file or directory while trying to open /dev/sda2 >/dev/sda2: >The superblock could not be read or does not describe a correct ext2 >filesystem. If the device is valid and it really contains an ext2 >filesystem (and not swap or ufs or something else), then the superblock >is corrupt, and you might try running e2fsck with an alternate superblock: > e2fsck -b 8193 <device> > ><snip> > > >-----------------[ Content of backup log testdisk backup.log ]------------- >#1255771918 Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63 > 1 : start= 63, size=123780762, Id=07, P > 2 : start=123780825, size= 5012280, Id=83, * > 3 : start=128793105, size=496344240, Id=05, E > > >>-----------------[ Content of logfile of testdisk testdisk.log ]------------- > >Sat Oct 17 05:28:14 2009 >Command line: TestDisk /log /dev/sda > >Using locale 'en_US.UTF-8'. >TestDisk 6.10, Data Recovery Utility, July 2008 >Christophe GRENIER <[email protected]> >http://www.cgsecurity.org >OS: Linux, kernel 2.6.18-128.1.1.el5 (#1 SMP Tue Feb 10 11:42:49 EST 2009) >Compiler: GCC 4.1 - Jul 26 2008 03:55:42 >ext2fs lib: 1.39, ntfs lib: 9:0:0, reiserfs lib: 0.3.0.4, ewf lib: none >Hard disk list >Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - ATA WDC >WD3200AAKS-0 > >Partition table type (auto): Intel >Disk /dev/sda - 320 GB / 298 GiB - ATA WDC WD3200AAKS-0 >Partition table type: Intel > >Interface Advanced >Geometry from i386 MBR: head=255 sector=63 >get_geometry_from_list_part_aux head=255 nbr=6 >get_geometry_from_list_part_aux head=8 nbr=1 >get_geometry_from_list_part_aux head=16 nbr=1 >get_geometry_from_list_part_aux head=32 > nbr=1 >get_geometry_from_list_part_aux head=64 nbr=1 >get_geometry_from_list_part_aux head=128 nbr=1 >get_geometry_from_list_part_aux head=240 nbr=1 >get_geometry_from_list_part_aux head=255 nbr=6 > 1 P HPFS - NTFS 0 1 1 7704 254 63 123780762 > NTFS, 63 GB / 59 GiB > 2 * Linux 7705 0 1 8016 254 63 5012280 [/boot1] > EXT3 Large file Sparse superblock Recover, 2566 MB / 2447 MiB > 3 E extended 8017 0 1 38912 254 63 496344240 > >Analyse Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63 >Geometry from i386 MBR: head=255 > sector=63 >get_geometry_from_list_part_aux head=255 nbr=6 >get_geometry_from_list_part_aux head=8 nbr=1 >get_geometry_from_list_part_aux head=16 nbr=1 >get_geometry_from_list_part_aux head=32 nbr=1 >get_geometry_from_list_part_aux head=64 nbr=1 >get_geometry_from_list_part_aux head=128 nbr=1 >get_geometry_from_list_part_aux head=240 nbr=1 >get_geometry_from_list_part_aux head=255 nbr=6 >Current partition structure: > 1 P HPFS - NTFS 0 1 1 7704 254 63 123780762 > 2 * Linux 7705 0 1 8016 254 63 5012280 [/boot1] > 3 E extended 8017 0 1 38912 254 63 496344240 >Backup > partition structure >Ask the user for vista mode >Allow partial last cylinder : No >search_vista_part: 0 > >search_part() >Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63 > D HPFS - NTFS 0 1 1 7704 254 63 123780762 > NTFS, 63 GB / 59 GiB > D Linux 7705 0 1 8016 254 63 5012280 [/boot1] > EXT3 Large file Sparse superblock Recover, 2566 MB / 2447 MiB >file_read(4,16,buffer,128793121(8017/0/17)) read err: Input/output error >file_read(4,1,buffer,128793121(8017/0/17)) read err: Input/output error >file_read(4,1,buffer,128793122(8017/0/18)) read err: Input/output error >file_read(4,1,buffer,128793123(8017/0/19)) > read err: Input/output error >file_read(4,16,buffer,128793168(8017/1/1)) read err: Input/output error >file_read(4,1,buffer,128793168(8017/1/1)) read err: Input/output error >file_read(4,1,buffer,128793169(8017/1/2)) read err: Input/output error >file_read(4,1,buffer,128793170(8017/1/3)) read err: Input/output error >file_read(4,16,buffer,128793184(8017/1/17)) read err: Input/output error >file_read(4,1,buffer,128793184(8017/1/17)) read err: Input/output error >file_read(4,1,buffer,128793185(8017/1/18)) read err: Input/output error ><snip> > > >__________________________________________________ >Do You Yahoo!? >Tired of spam? Yahoo! Mail has the best spam protection around >http://mail.yahoo.com
