Re: OT: fdisk - Data Recovered
On Mon, 4 Oct 2010 11:42:49 -0700 Robert travelin...@cox.net wrote: On Tue, 5 Oct 2010 03:53:09 +1100 (EST) Ian Smith smi...@nimnet.asn.au wrote: Ian I am in the process of dd the entire disk to a 1TB disk but I wanted to respond to you. You have given a lot of good advice and information and I appreciate it. To all who responded to my ntfs fiasco, not only do I thank you but the wife passes along her thanks and makes the point that she didn't need a second bottle of wine. :-) The above dd operation finished late last night but I didn't start working on until this morning. Using FreeBSD it acted exactly as the other dd attempts did, i.e. I could mount_ntfs /dev/ad6 and see the same as I did before but ad6s1 failed to mount as ntfs. ad6s1 would mount with no fs specified but nothing was readable. I rebooted into Windows XP and to my surprise the computer restarted right after the desktop rendered. I then booted into safe mode with command prompt. This booted successfully and then I changed drives until I found the data I was looking for. The 1tb drive, now showing as 500GB, appeared as drive G: I ran chkdsk against g: and after finding and clearing several errors it quit without completing. I tried to boot normal and the computer rebooted after the desktop rendered again. I then booted into safe mode and it came up and ran OK. I was able to open the drive and see the data I needed. I inserted a thumb drive and copied the data over. I'm her hero again and we will have the second bottle tonight. :-) Thanks again to everyone for all the great help. Robert ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: OT: fdisk
On Mon, 4 Oct 2010 07:52:21 -0700 Robert travelin...@cox.net wrote: On Mon, 4 Oct 2010 16:32:25 +0200 Polytropon free...@edvax.de wrote: On Mon, 4 Oct 2010 07:08:58 -0700, Robert travelin...@cox.net wrote: I have now a free 1TB drive for use. It is formatted as UFS. Should I remove formatting before I dd the 500GB drive to it? Not needed, as you're going to use it under the control of FreeBSD. After formatting and mounting it, let's say as /mnt, use dd (or ddrescue) to first get an 1:1 copy of the source disk. It is being performed even as we speak. Update [r...@asus64] ~# dd if=/dev/da1 of=/1tb/disk500.img bs=1m 476940+1 records in 476940+1 records out 500107862016 bytes transferred in 47027.134085 secs (10634453 bytes/sec) ~ 14 hours later here is what I have. [r...@asus64] ~# ls -l /1tb total 488625218 drwxrwxr-x 2 root operator 512 Jan 19 2010 .snap -rw-r--r-- 1 root wheel 500107862016 Oct 5 01:07 disk500.img [r...@asus64] ~# mdconfig -a -t vnode -u 12 -f /1tb/disk500.img [r...@asus64] ~# ls -l /dev/md* crw-r- 1 root operator0, 129 Oct 4 06:43 /dev/md10 crw-r- 1 root operator0, 130 Oct 4 06:43 /dev/md10s1 crw-r- 1 root operator0, 131 Oct 5 05:55 /dev/md12 crw-r- 1 root operator0, 133 Oct 5 05:55 /dev/md12s1 crw--- 1 root wheel 0, 66 Oct 1 14:43 /dev/mdctl [r...@asus64] ~# mount_ntfs /dev/md12s1 /mnt mount_ntfs: /dev/md12s1: Invalid argument [r...@asus64] ~# mount_ntfs /dev/md12 /mnt [r...@asus64] ~# ls -l /mnt total 70044 -rwxr-xr-x 1 root wheel 2560 Dec 31 1600 $AttrDef -rwxr-xr-x 1 root wheel 0 Oct 1 09:09 $BadClus -rwxr-xr-x 1 root wheel 4194304 Dec 31 1600 $Bitmap -rwxr-xr-x 1 root wheel 8192 Oct 1 09:09 $Boot drwxr-xr-x 1 root wheel 0 Oct 1 09:09 $Extend -rwxr-xr-x 1 root wheel 67108864 Oct 1 09:09 $LogFile -rwxr-xr-x 1 root wheel 4096 Oct 1 09:09 $MFTMirr -rwxr-xr-x 1 root wheel 0 Dec 31 1600 $Secure -rwxr-xr-x 1 root wheel131072 Oct 1 09:09 $UpCase -rwxr-xr-x 1 root wheel 0 Oct 1 09:09 $Volume -rwxr-xr-x 1 root wheel 45124 Aug 18 2001 NTDETECT.COM drwxr-xr-x 1 root wheel 0 Oct 1 17:29 System Volume Information -rwxr-xr-x 1 root wheel 193 Oct 1 09:12 boot.ini -rwxr-xr-x 1 root wheel222368 Aug 18 2001 ntldr [r...@asus64] ~# umount /mnt [r...@asus64] ~# mount /dev/md12s1 /mnt [r...@asus64] ~# ls -l /mnt total 0 [r...@asus64] ~# df -h Filesystem SizeUsed Avail Capacity Mounted on /dev/label/rootfs989M523M387M57%/ devfs1.0K1.0K 0B 100%/dev /dev/label/home 9.7G2.0G6.9G22%/home /dev/label/slice2 56G 53G -1.4G 103%/slice2 /dev/label/slice3 56G4.0K 52G 0%/slice3 /dev/label/slice4 56G 39G 13G76%/slice4 /dev/label/spare 20G6.0K 18G 0%/spare /dev/label/tmp 484M 22M423M 5%/tmp /dev/label/usr20G7.5G 11G40%/usr /dev/label/var 989M158M752M17%/var /dev/label/500ext451G153G262G37%/500ext /dev/label/1tb 902G466G364G56%/1tb /dev/ad12s1d 226G 59G149G28%/250extra /dev/md12s1 451G 32G383G 8%/mnt ^^^ Everything is exactly the same as when I tried only 60GB. I am now going to zero the 1TB drive and dd the 500GB drive to it. dd if=/dev/da1 of=/dev/ad6 bs=1m I will then try windows chkdsk on the 1TB drive. Thanks to everyone who has added input. If I can get this working I will summarize what it took to solve this puzzle. Henry wrote: And still the wife doesn't suspect? Of course she knows that the computer died and that I am in the process of recovering all of her data. I re-installed XP Pro on another computer and moved what data I did save onto it. She is happy that she can check email, balance her check book and play on Facebook. :-) We will be drinking wine tonight. To be continued. Robert ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: OT: fdisk
On Tue, 5 Oct 2010 06:20:29 -0700, Robert travelin...@cox.net wrote: Update [r...@asus64] ~# dd if=/dev/da1 of=/1tb/disk500.img bs=1m 476940+1 records in 476940+1 records out 500107862016 bytes transferred in 47027.134085 secs (10634453 bytes/sec) ~ 14 hours later here is what I have. [r...@asus64] ~# ls -l /1tb total 488625218 drwxrwxr-x 2 root operator 512 Jan 19 2010 .snap -rw-r--r-- 1 root wheel 500107862016 Oct 5 01:07 disk500.img You got a copy of the entire disk. This is GOOD as you're not missing something important. [r...@asus64] ~# mdconfig -a -t vnode -u 12 -f /1tb/disk500.img [r...@asus64] ~# ls -l /dev/md* crw-r- 1 root operator0, 129 Oct 4 06:43 /dev/md10 crw-r- 1 root operator0, 130 Oct 4 06:43 /dev/md10s1 crw-r- 1 root operator0, 131 Oct 5 05:55 /dev/md12 crw-r- 1 root operator0, 133 Oct 5 05:55 /dev/md12s1 crw--- 1 root wheel 0, 66 Oct 1 14:43 /dev/mdctl Erm... erm erm erm!!! After using a md file that is connected to an image file, and you purge the image file, destroy the md file. Use mdconfig -d -u 10 for unit 10, for example. See details in man mdconfig. [r...@asus64] ~# mount_ntfs /dev/md12s1 /mnt mount_ntfs: /dev/md12s1: Invalid argument This is the 1st primary partition with NTFS content, this one can't be mounted. [r...@asus64] ~# mount_ntfs /dev/md12 /mnt [r...@asus64] ~# ls -l /mnt total 70044 -rwxr-xr-x 1 root wheel 2560 Dec 31 1600 $AttrDef -rwxr-xr-x 1 root wheel 0 Oct 1 09:09 $BadClus -rwxr-xr-x 1 root wheel 4194304 Dec 31 1600 $Bitmap -rwxr-xr-x 1 root wheel 8192 Oct 1 09:09 $Boot drwxr-xr-x 1 root wheel 0 Oct 1 09:09 $Extend -rwxr-xr-x 1 root wheel 67108864 Oct 1 09:09 $LogFile -rwxr-xr-x 1 root wheel 4096 Oct 1 09:09 $MFTMirr -rwxr-xr-x 1 root wheel 0 Dec 31 1600 $Secure -rwxr-xr-x 1 root wheel131072 Oct 1 09:09 $UpCase -rwxr-xr-x 1 root wheel 0 Oct 1 09:09 $Volume -rwxr-xr-x 1 root wheel 45124 Aug 18 2001 NTDETECT.COM drwxr-xr-x 1 root wheel 0 Oct 1 17:29 System Volume Information -rwxr-xr-x 1 root wheel 193 Oct 1 09:12 boot.ini -rwxr-xr-x 1 root wheel222368 Aug 18 2001 ntldr [r...@asus64] ~# umount /mnt This is the second NTFS volume, can be mounted. [r...@asus64] ~# mount /dev/md12s1 /mnt Why can the first one NOW be mounted??? [r...@asus64] ~# ls -l /mnt total 0 [r...@asus64] ~# df -h Filesystem SizeUsed Avail Capacity Mounted on /dev/label/rootfs989M523M387M57%/ devfs1.0K1.0K 0B 100%/dev /dev/label/home 9.7G2.0G6.9G22%/home /dev/label/slice2 56G 53G -1.4G 103%/slice2 /dev/label/slice3 56G4.0K 52G 0%/slice3 /dev/label/slice4 56G 39G 13G76%/slice4 /dev/label/spare 20G6.0K 18G 0%/spare /dev/label/tmp 484M 22M423M 5%/tmp /dev/label/usr20G7.5G 11G40%/usr /dev/label/var 989M158M752M17%/var /dev/label/500ext451G153G262G37%/500ext /dev/label/1tb 902G466G364G56%/1tb /dev/ad12s1d 226G 59G149G28%/250extra /dev/md12s1 451G 32G383G 8%/mnt ^^^ This looks like missing data. In terms of UFS file system, one would say that there a inodes not referenced, but still occupied as they are not marked as being free. Sadly, I have *zero* knowledge about NTFS to make an interpretation about what we see here... Everything is exactly the same as when I tried only 60GB. I am now going to zero the 1TB drive and dd the 500GB drive to it. dd if=/dev/da1 of=/dev/ad6 bs=1m I will then try windows chkdsk on the 1TB drive. Maybe you need - after this transfer - to write the 512 byte blocks at the beginning separately (dd if=/dev/da1 of=/dev/ad6 bs=512 count=1)? Because of MBR and such? Thanks to everyone who has added input. If I can get this working I will summarize what it took to solve this puzzle. Good luck! -- Polytropon Magdeburg, Germany Happy FreeBSD user since 4.0 Andra moi ennepe, Mousa, ... ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: OT: fdisk
On Tue, 5 Oct 2010 15:34:41 +0200 Polytropon free...@edvax.de wrote: On Tue, 5 Oct 2010 06:20:29 -0700, Robert travelin...@cox.net wrote: Update [r...@asus64] ~# dd if=/dev/da1 of=/1tb/disk500.img bs=1m 476940+1 records in 476940+1 records out 500107862016 bytes transferred in 47027.134085 secs (10634453 bytes/sec) ~ 14 hours later here is what I have. [r...@asus64] ~# ls -l /1tb total 488625218 drwxrwxr-x 2 root operator 512 Jan 19 2010 .snap -rw-r--r-- 1 root wheel 500107862016 Oct 5 01:07 disk500.img You got a copy of the entire disk. This is GOOD as you're not missing something important. [r...@asus64] ~# mdconfig -a -t vnode -u 12 -f /1tb/disk500.img [r...@asus64] ~# ls -l /dev/md* crw-r- 1 root operator0, 129 Oct 4 06:43 /dev/md10 crw-r- 1 root operator0, 130 Oct 4 06:43 /dev/md10s1 crw-r- 1 root operator0, 131 Oct 5 05:55 /dev/md12 crw-r- 1 root operator0, 133 Oct 5 05:55 /dev/md12s1 crw--- 1 root wheel 0, 66 Oct 1 14:43 /dev/mdctl Erm... erm erm erm!!! After using a md file that is connected to an image file, and you purge the image file, destroy the md file. Use mdconfig -d -u 10 for unit 10, for example. See details in man mdconfig. [r...@asus64] ~# mount_ntfs /dev/md12s1 /mnt mount_ntfs: /dev/md12s1: Invalid argument This is the 1st primary partition with NTFS content, this one can't be mounted. As ntfs. [r...@asus64] ~# mount_ntfs /dev/md12 /mnt [r...@asus64] ~# ls -l /mnt total 70044 -rwxr-xr-x 1 root wheel 2560 Dec 31 1600 $AttrDef -rwxr-xr-x 1 root wheel 0 Oct 1 09:09 $BadClus -rwxr-xr-x 1 root wheel 4194304 Dec 31 1600 $Bitmap -rwxr-xr-x 1 root wheel 8192 Oct 1 09:09 $Boot drwxr-xr-x 1 root wheel 0 Oct 1 09:09 $Extend -rwxr-xr-x 1 root wheel 67108864 Oct 1 09:09 $LogFile -rwxr-xr-x 1 root wheel 4096 Oct 1 09:09 $MFTMirr -rwxr-xr-x 1 root wheel 0 Dec 31 1600 $Secure -rwxr-xr-x 1 root wheel131072 Oct 1 09:09 $UpCase -rwxr-xr-x 1 root wheel 0 Oct 1 09:09 $Volume -rwxr-xr-x 1 root wheel 45124 Aug 18 2001 NTDETECT.COM drwxr-xr-x 1 root wheel 0 Oct 1 17:29 System Volume Information -rwxr-xr-x 1 root wheel 193 Oct 1 09:12 boot.ini -rwxr-xr-x 1 root wheel222368 Aug 18 2001 ntldr [r...@asus64] ~# umount /mnt This is the second NTFS volume, can be mounted. Without any of the data. [r...@asus64] ~# mount /dev/md12s1 /mnt Why can the first one NOW be mounted??? As ufs [r...@asus64] ~# ls -l /mnt total 0 [r...@asus64] ~# df -h Filesystem SizeUsed Avail Capacity Mounted on /dev/label/rootfs989M523M387M57%/ devfs1.0K1.0K 0B 100%/dev /dev/label/home 9.7G2.0G6.9G22%/home /dev/label/slice2 56G 53G -1.4G 103%/slice2 /dev/label/slice3 56G4.0K 52G 0%/slice3 /dev/label/slice4 56G 39G 13G76%/slice4 /dev/label/spare 20G6.0K 18G 0%/spare /dev/label/tmp 484M 22M423M 5%/tmp /dev/label/usr20G7.5G 11G40%/usr /dev/label/var 989M158M752M17%/var /dev/label/500ext451G153G262G37%/500ext /dev/label/1tb 902G466G364G56%/1tb /dev/ad12s1d 226G 59G149G28%/250extra /dev/md12s1 451G 32G383G 8%/mnt ^^^ This looks like missing data. In terms of UFS file system, one would say that there a inodes not referenced, but still occupied as they are not marked as being free. Sadly, I have *zero* knowledge about NTFS to make an interpretation about what we see here... Good luck! Thanks for that :-) ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: OT: fdisk
On Saturday 02 of October 2010 20:36:40 Robert wrote: Greetings Maybe good tool will be System Rescue CD, Linux Live distribution, it has a tool named ntfs-3g and ntfsprogs. See here: http://www.sysresccd.org/Main_Page http://www.sysresccd.org/Sysresccd-manual-en_Mounting_an_NTFS_partition_with_full_Read-Write_support Thanks for any suggestions. Good luck! Robert Zbigniew ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: OT: fdisk
On Sun, 3 Oct 2010 22:27:02 -0600 (MDT), Warren Block wbl...@wonkity.com wrote: On Sun, 3 Oct 2010, Polytropon wrote: On Sun, 3 Oct 2010 10:00:51 -0700, Robert travelin...@cox.net wrote: I have a spare 250G hard drive. Can I use dd to capture 250 gigs from the old drive? Using da1 and ad12 as the if and of will the result be an NTFS formatted 250g drive? Will I have the same results, i.e. able to mount ad12 but not ad12s1? Yes, as dd gives you an 1:1 copy of what you have. It will give an exact copy of the first 250G, which also means it will not resize the 500G filesystem into a working 250G version. The first step would be a copy of the entire drive. Then the filesystem can be repaired and resized. Exactly. NEVER mess with the precious data. Only read, then store away the drive. If all files are back, the drive can be cleanly reformatted and then populated with the original files. All investigation and modification tasks should be done with a copy. If you mess up a copy, get a new one. As hard disks are cheap, it might be worth buying a new one just to have enough disk space available for such tasks. Remember: Hard disks are cheap, your data isn't. :-) -- Polytropon Magdeburg, Germany Happy FreeBSD user since 4.0 Andra moi ennepe, Mousa, ... ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: OT: fdisk
On Mon, 4 Oct 2010 12:34:13 +0200 Polytropon free...@edvax.de wrote: On Sun, 3 Oct 2010 14:29:35 -0700, Robert travelin...@cox.net wrote: Thanks for the info. I successfully did the above and now I have a 58.6GB file named disk.img on a UFS disk. Umm, what should I do now. Sorry for dumb question number 37 this weekend but I am a bit confused. Can I do just the opposite to another NTFS drive and end up with all the data looking like it should? I.E. dd from the file to an NTFS disk. You can now use the file as if it were a disk. To turn it into a device, simply do % mkdir mnt % sudo mdconfig -a -t vnode -u 10 -f disk.img % mount -o ro /dev/md10 mnt/ This should give you the chance to extract files from it. You can also use fdisk on the /dev/md10 file (or any other unit number given by -u you want to use). I have now a free 1TB drive for use. It is formatted as UFS. Should I remove formatting before I dd the 500GB drive to it? I tried the above process and here is what I have. [r...@asus64] ~# mdconfig -a -t vnode -u 10 -f /250extra/disk.img [r...@asus64] ~# mount -o ro /dev/md10 /mnt mount: /dev/md10 : Invalid argument [r...@asus64] ~# mount_ntfs -o ro /dev/md10 /mnt mount_ntfs: /dev/md10: Input/output error [r...@asus64] ~# ls -l /dev/md* crw-r- 1 root operator0, 129 Oct 4 06:43 /dev/md10 crw-r- 1 root operator0, 130 Oct 4 06:43 /dev/md10s1 crw--- 1 root wheel 0, 66 Oct 1 14:43 /dev/mdctl [r...@asus64] ~# mount -o ro /dev/md10s1 /mnt [r...@asus64] ~# ls -l /mnt total 0 [r...@asus64] ~# df -h Filesystem SizeUsed Avail Capacity Mounted on snip /dev/ad12s1d 226G 59G149G28%/250extra /dev/md10s1 451G 32G383G 8%/mnt ^^^ [r...@asus64] ~# ls -la /mnt total 0 Warren wrote: It will give an exact copy of the first 250G, which also means it will not resize the 500G filesystem into a working 250G version. Same questions as above. Can I dd to a 1TB? And what format on the drive? I apologize again if I am coming off as dense. I have not used dd before as I have always used dump for backups. Robert ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: OT: fdisk
On Mon, 4 Oct 2010 07:08:58 -0700, Robert travelin...@cox.net wrote: I have now a free 1TB drive for use. It is formatted as UFS. Should I remove formatting before I dd the 500GB drive to it? Not needed, as you're going to use it under the control of FreeBSD. After formatting and mounting it, let's say as /mnt, use dd (or ddrescue) to first get an 1:1 copy of the source disk. I tried the above process and here is what I have. [r...@asus64] ~# mdconfig -a -t vnode -u 10 -f /250extra/disk.img [r...@asus64] ~# mount -o ro /dev/md10 /mnt mount: /dev/md10 : Invalid argument Of course. :-) [r...@asus64] ~# mount_ntfs -o ro /dev/md10 /mnt mount_ntfs: /dev/md10: Input/output error This indicates that the NTFS seems to be damaged and prevents mount_ntfs from mounting it. Start with baby steps: Is there a valid partition table? # fdisk /dev/md10 You should now get a partition table. Did you create disk.img by dd'ing da0 or da0s1? This may matter. [r...@asus64] ~# ls -l /dev/md* crw-r- 1 root operator0, 129 Oct 4 06:43 /dev/md10 crw-r- 1 root operator0, 130 Oct 4 06:43 /dev/md10s1 crw--- 1 root wheel 0, 66 Oct 1 14:43 /dev/mdctl [r...@asus64] ~# mount -o ro /dev/md10s1 /mnt Good. At least a bit. [r...@asus64] ~# ls -l /mnt total 0 [r...@asus64] ~# df -h Filesystem SizeUsed Avail Capacity Mounted on snip /dev/ad12s1d 226G 59G149G28%/250extra /dev/md10s1 451G 32G383G 8%/mnt ^^^ [r...@asus64] ~# ls -la /mnt total 0 Hmmm... you dd'ed the WHOLE disk to disk.img? Does the size look reasonable? Warren wrote: It will give an exact copy of the first 250G, which also means it will not resize the 500G filesystem into a working 250G version. Same questions as above. Can I dd to a 1TB? And what format on the drive? Format the target disk as UFS, as you do with any disk you want to use for FreeBSD. Then dd (or ddrescue) the source disk to a file on that target disk. Then connect this file to a memory disk (md) device. Check the fdisk output for that device. Mount it. Get your data off. I apologize again if I am coming off as dense. I have not used dd before as I have always used dump for backups. Correct: dump + restore are used for UFS backups, but in this case, you need to deal with Windows stuff that does not support such standard means. That's why you need dd to make an 1:1 copy to work with it as you would work on the original disk. -- Polytropon Magdeburg, Germany Happy FreeBSD user since 4.0 Andra moi ennepe, Mousa, ... ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: OT: fdisk
On Mon, 4 Oct 2010 16:32:25 +0200
Polytropon free...@edvax.de wrote:
On Mon, 4 Oct 2010 07:08:58 -0700, Robert travelin...@cox.net wrote:
I have now a free 1TB drive for use. It is formatted as UFS. Should
I remove formatting before I dd the 500GB drive to it?
Not needed, as you're going to use it under the control of FreeBSD.
After formatting and mounting it, let's say as /mnt, use dd (or
ddrescue) to first get an 1:1 copy of the source disk.
It is being performed even as we speak.
I tried the above process and here is what I have.
[r...@asus64] ~# mdconfig -a -t vnode -u 10 -f /250extra/disk.img
[r...@asus64] ~# mount -o ro /dev/md10 /mnt
mount: /dev/md10 : Invalid argument
Of course. :-)
[r...@asus64] ~# mount_ntfs -o ro /dev/md10 /mnt
mount_ntfs: /dev/md10: Input/output error
This indicates that the NTFS seems to be damaged and prevents
mount_ntfs from mounting it. Start with baby steps: Is there
a valid partition table?
# fdisk /dev/md10
[r...@asus64] ~# fdisk /dev/md10
*** Working on device /dev/md10 ***
parameters extracted from in-core disklabel are:
cylinders=7648 heads=255 sectors/track=63 (16065 blks/cyl)
Figures below won't work with BIOS for partitions not in cyl 1
parameters to be used for BIOS calculations are:
cylinders=7648 heads=255 sectors/track=63 (16065 blks/cyl)
Media sector size is 512
Warning: BIOS sector numbering starts with sector 1
Information from DOS bootblock is:
The data for partition 1 is:
sysid 7 (0x07),(NTFS, OS/2 HPFS, QNX-2 (16 bit) or Advanced UNIX)
start 63, size 976773105 (476939 Meg), flag 0
beg: cyl 0/ head 1/ sector 1;
end: cyl 1023/ head 15/ sector 63
The data for partition 2 is:
UNUSED
The data for partition 3 is:
UNUSED
The data for partition 4 is:
UNUSED
You should now get a partition table.
Did you create disk.img by dd'ing da0 or da0s1? This may matter.
da1...but not the entire disk.
[r...@asus64] ~# ls -l /dev/md*
crw-r- 1 root operator0, 129 Oct 4 06:43 /dev/md10
crw-r- 1 root operator0, 130 Oct 4 06:43 /dev/md10s1
crw--- 1 root wheel 0, 66 Oct 1 14:43 /dev/mdctl
[r...@asus64] ~# mount -o ro /dev/md10s1 /mnt
Good. At least a bit.
Is this the way to mount it, not _ntfs?
[r...@asus64] ~# ls -l /mnt
total 0
[r...@asus64] ~# df -h
Filesystem SizeUsed Avail Capacity Mounted on
snip
/dev/ad12s1d 226G 59G149G28%/250extra
/dev/md10s1 451G 32G383G 8%/mnt
^^^
[r...@asus64] ~# ls -la /mnt
total 0
Hmmm... you dd'ed the WHOLE disk to disk.img? Does the size look
reasonable?
No. I was trying to just get the data to a 250GB drive. Now I am doing
the 500GB to a 1TB drive and will follow up when complete.
Robert
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: OT: fdisk
On Sun, 3 Oct 2010 14:29:35 -0700, Robert travelin...@cox.net wrote: Thanks for the info. I successfully did the above and now I have a 58.6GB file named disk.img on a UFS disk. Umm, what should I do now. Sorry for dumb question number 37 this weekend but I am a bit confused. Can I do just the opposite to another NTFS drive and end up with all the data looking like it should? I.E. dd from the file to an NTFS disk. You can now use the file as if it were a disk. To turn it into a device, simply do % mkdir mnt % sudo mdconfig -a -t vnode -u 10 -f disk.img % mount -o ro /dev/md10 mnt/ This should give you the chance to extract files from it. You can also use fdisk on the /dev/md10 file (or any other unit number given by -u you want to use). I wouldn't dd the file back to the original drive, that might make things worse. For data extraction, I suggest dd'ing the WHOLE disk into an image file and then working with this file, having the original disk not touched anymore until the data is back. See /usr/local/share/doc/sleuthkit/skins_ntfs.txt from TSK (port: sleuthkit) for details about NTFS file recovery. As you did show that you could mount the disk (I think you presented a ls output with typical Windows files) this should be possible again after fixing the partition table. I have to admit that I've got NO CLUE about Windows file systems as I don't use them, so I sadly can't be more specific. You can also use ddrescue instead of dd, as it allows resuming a dd operation, and it will dynamically adjust read block sizes, so it might run faster. % ddrescue -d -r 3 -n /dev/ad12 ntfs.ddr log.txt If mounting does not work, you can use tools like photorec on the /dev/md10 file which will extract known file types. The tool magicrescue also could work: % magicrescue -r /usr/local/share/magicrescue/recipes -d mr_output /dev/md10 -- Polytropon Magdeburg, Germany Happy FreeBSD user since 4.0 Andra moi ennepe, Mousa, ... ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: OT: fdisk
On Mon, 4 Oct 2010 07:52:21 -0700, Robert travelin...@cox.net wrote: On Mon, 4 Oct 2010 16:32:25 +0200 Polytropon free...@edvax.de wrote: [r...@asus64] ~# fdisk /dev/md10 *** Working on device /dev/md10 *** parameters extracted from in-core disklabel are: cylinders=7648 heads=255 sectors/track=63 (16065 blks/cyl) Figures below won't work with BIOS for partitions not in cyl 1 parameters to be used for BIOS calculations are: cylinders=7648 heads=255 sectors/track=63 (16065 blks/cyl) Media sector size is 512 Warning: BIOS sector numbering starts with sector 1 Information from DOS bootblock is: The data for partition 1 is: sysid 7 (0x07),(NTFS, OS/2 HPFS, QNX-2 (16 bit) or Advanced UNIX) start 63, size 976773105 (476939 Meg), flag 0 beg: cyl 0/ head 1/ sector 1; end: cyl 1023/ head 15/ sector 63 The data for partition 2 is: UNUSED The data for partition 3 is: UNUSED The data for partition 4 is: UNUSED Okay, as I see it, this looks valid - a working partition table. What can prevent mounting now is a defect in the NTFS MFT, everything after the disk's partition table. [r...@asus64] ~# ls -l /dev/md* crw-r- 1 root operator0, 129 Oct 4 06:43 /dev/md10 crw-r- 1 root operator0, 130 Oct 4 06:43 /dev/md10s1 crw--- 1 root wheel 0, 66 Oct 1 14:43 /dev/mdctl [r...@asus64] ~# mount -o ro /dev/md10s1 /mnt Good. At least a bit. Is this the way to mount it, not _ntfs? My fault: Using mount_ntfs is the correct way (or mount -t ntfs); mount without options for a device / directory NOT listed in fstab defaults to UFS. No. I was trying to just get the data to a 250GB drive. Now I am doing the 500GB to a 1TB drive and will follow up when complete. Very good. You can check the progress by issuing ^T - dd will then show a status message. If you're using ddrescue (no big difference here), you'll get some more info, like this: % ddrescue -d -r 3 -n /dev/ad1s1f ad1s1f.ddr log.txt Press Ctrl-C to interrupt Initial status (read from logfile) rescued: 0 B, errsize: 0 B, errors: 0 Current status rescued:90772 MB, errsize: 0 B, current rate:6815 kB/s ipos:90772 MB, errors: 0,average rate:6723 kB/s opos:90772 MB Finished This example is 3h 45min for 80 GB from one (P)ATA disk to another. You can watch the progress continuously here. -- Polytropon Magdeburg, Germany Happy FreeBSD user since 4.0 Andra moi ennepe, Mousa, ... ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: OT: fdisk
In freebsd-questions Digest, Vol 331, Issue 1, Message: 5 On Sun, 3 Oct 2010 08:19:36 -0500 (CDT) Robert Bonomi bon...@mail.r-bonomi.com wrote: On Sat, 2 Oct 2010 17:00:00 -0600 (MDT) Warren Block wbl...@wonkity.com wrote: On Sat, 2 Oct 2010, Robert wrote: Greetings I am in deep with the wife. Her computer went belly up. It was running XP pro and I had backups going to a second drive. I can no longer access that drive. I pulled it and attached it via USB to one of my FreeBSD machines but it will not mount. It is a 500G hard drive and I get _wild_ results just looking at it with fdisk. ~ fdisk /dev/da1s1 *** Working on device /dev/da1s1 *** Wait a minute... shouldn't that be just da1? da1s1 is the first slice (partition), and the data there should be your XP filesystem, probably NTFS. Warren, You are right. Here it is: ~ fdisk /dev/da1 *** Working on device /dev/da1 *** parameters extracted from in-core disklabel are: cylinders=60801 heads=255 sectors/track=63 (16065 blks/cyl) Figures below won't work with BIOS for partitions not in cyl 1 parameters to be used for BIOS calculations are: cylinders=60801 heads=255 sectors/track=63 (16065 blks/cyl) Media sector size is 512 Warning: BIOS sector numbering starts with sector 1 Information from DOS bootblock is: The data for partition 1 is: sysid 7 (0x07),(NTFS, OS/2 HPFS, QNX-2 (16 bit) or Advanced UNIX) start 63, size 976773105 (476939 Meg), flag 0 beg: cyl 0/ head 1/ sector 1; end: cyl 1023/ head 15/ sector 63 The data for partition 2 is: UNUSED The data for partition 3 is: UNUSED The data for partition 4 is: UNUSED Robert Bonomi, replying to yours before the above slipped away, but I'm directing this to Robert the OP, ok? So pausing here for a bit .. starting at 63 (cyl 0/ head 1/ sector1 in CHS terms), looks correct for s1, one slice, whole disk for NTFS. That should rule out a damaged MBR in sector 0 - though it doesn't rule out the boot code in the first 2 or so sectors having been clobbered. You can often poke around the beginning of disks to advantage with say: # dd if=/dev/da1 bs=512 count=126 | hd | less to see the first two tracks .. sector 63 should be where NTFS starts, ie after sectors 0-62 on head 0. hd(1) skips repeated zeroes or 0xff and such, so you can hunt through quite a lot of early sectors without huge output in less, usually. Which looks a lot better. I can mount /dev/da1 and it shows Just to be clear, you mean: '# mount_ntfs /dev/da1 /mnt' ? (try to be sure to mount NTFS filesystems _explicitly_ read-only, especially if likely damaged) ~ ls -l /mnt total 70044 -rwxr-xr-x 1 root wheel 2560 Dec 31 1600 $AttrDef -rwxr-xr-x 1 root wheel 0 Oct 1 09:09 $BadClus -rwxr-xr-x 1 root wheel 4194304 Dec 31 1600 $Bitmap -rwxr-xr-x 1 root wheel 8192 Oct 1 09:09 $Boot drwxr-xr-x 1 root wheel 0 Oct 1 09:09 $Extend -rwxr-xr-x 1 root wheel 67108864 Oct 1 09:09 $LogFile -rwxr-xr-x 1 root wheel 4096 Oct 1 09:09 $MFTMirr -rwxr-xr-x 1 root wheel 0 Dec 31 1600 $Secure -rwxr-xr-x 1 root wheel131072 Oct 1 09:09 $UpCase -rwxr-xr-x 1 root wheel 0 Oct 1 09:09 $Volume -rwxr-xr-x 1 root wheel 45124 Aug 18 2001 NTDETECT.COM drwxr-xr-x 1 root wheel 0 Oct 1 17:29 System Volume Information -rwxr-xr-x 1 root wheel 193 Oct 1 09:12 boot.ini -rwxr-xr-x 1 root wheel222368 Aug 18 2001 ntldr But I cannot mount /dev/da1s1 ~ sudo mount_ntfs /dev/da1s1 /mnt mount_ntfs: /dev/da1s1: Invalid argument Ok, and its not clear why/how mount_ntfs would be happy mounting da1 'raw' but it sure looks like (at least part of) an NTFS root directory; not necessarily all what you'd see as C:\ in windows explorer, say; windows plays strange tricks the way it layers directories for display. There's weird dates (1600?) and only you would know if those October 1st timestamps are of when you mounted it, or when windows last accessed it? The fact that boot.ini is a few minutes later than some is interesting; that's where entries for multi-booting NT may exist, and maybe something messed with that, hardware glitch? or (not entirely unknown :) one of a hundred thousand or so viruses? So, can you look at these files when so mounted? Can you do something like 'du -d2 /mnt' and see anything useful? I'm just guessing /hoping here that the disk may not be as badly scrambled as you fear, despite the apparent oddness of it mounting like that. From a later message, quoting Robert: Warren, thanks for the link. I will be reading it and increasing my understanding of NTFS. Though it's an old (pre-XP) article, it's good basics. Note especially that NTFS keeps a copy somewhere near the
Re: OT: fdisk
On Tue, 5 Oct 2010 03:53:09 +1100 (EST) Ian Smith smi...@nimnet.asn.au wrote: Ian I am in the process of dd the entire disk to a 1TB disk but I wanted to respond to you. You have given a lot of good advice and information and I appreciate it. ~ fdisk /dev/da1 *** Working on device /dev/da1 *** parameters extracted from in-core disklabel are: cylinders=60801 heads=255 sectors/track=63 (16065 blks/cyl) Figures below won't work with BIOS for partitions not in cyl 1 parameters to be used for BIOS calculations are: cylinders=60801 heads=255 sectors/track=63 (16065 blks/cyl) Media sector size is 512 Warning: BIOS sector numbering starts with sector 1 Information from DOS bootblock is: The data for partition 1 is: sysid 7 (0x07),(NTFS, OS/2 HPFS, QNX-2 (16 bit) or Advanced UNIX) start 63, size 976773105 (476939 Meg), flag 0 beg: cyl 0/ head 1/ sector 1; end: cyl 1023/ head 15/ sector 63 The data for partition 2 is: UNUSED The data for partition 3 is: UNUSED The data for partition 4 is: UNUSED So pausing here for a bit .. starting at 63 (cyl 0/ head 1/ sector1 in CHS terms), looks correct for s1, one slice, whole disk for NTFS. That should rule out a damaged MBR in sector 0 - though it doesn't rule out the boot code in the first 2 or so sectors having been clobbered. I have tried earlier to explain what might/could have happened but was most likely not specific enough. I will try to do better. This was the wife's computer. It had Xp Pro on the first slice and FreeBSD 7.x on the second. Windows started acting strange and then was rebooting as soon as the desktop rendered. I booted to safe mode and went back one day in the recover option. Same thing happened, i.e. reboot after desktop rendered. I again booted in safe mode and went back two days. Could never get it to boot again even in safe mode. I booted into FreeBSD and copied some critical files off of the Windows slice that she was desperate to have. I put them on a pen drive so she could then access via her laptop. I checked the backup drive and saw that all was fine. I had the D$S stuff backing up nightly. I was able to mount either drive with _ntfs or ntfs-3g. No matter what I tried I could not get windows to boot even in safe mode. I left it running on FreeBSD aver night expecting to have to reinstall windows in the morning. The next day the system had rebooted with the GAG screen up. I ran memtest for about 6 hours and it showed a couple of faults. I pulled one of the three 512M memory chips and it seemed to run OK but still could not boot windows. I reinstalled windows and was doing all of the updates when it started failing to boot. Somewhere in that time the backup (500GB) drive became invisible to windows. FreeBSD showed only ad6 without the s1 partition. I used sade to look at it and it did not show as ntfs. I marked it as ntfs thinking that would fix it but it probably caused all of these problems. Whatever is wrong with that computer it now completely messed up. It will not even power on. I strapped out the power connect pins 3 and 4 and the PS runs and the voltages check out. You can often poke around the beginning of disks to advantage with say: # dd if=/dev/da1 bs=512 count=126 | hd | less to see the first two tracks .. sector 63 should be where NTFS starts, ie after sectors 0-62 on head 0. hd(1) skips repeated zeroes or 0xff and such, so you can hunt through quite a lot of early sectors without huge output in less, usually. Which looks a lot better. I can mount /dev/da1 and it shows Just to be clear, you mean: '# mount_ntfs /dev/da1 /mnt' ? (try to be sure to mount NTFS filesystems _explicitly_ read-only, especially if likely damaged) ~ ls -l /mnt total 70044 -rwxr-xr-x 1 root wheel 2560 Dec 31 1600 $AttrDef -rwxr-xr-x 1 root wheel 0 Oct 1 09:09 $BadClus -rwxr-xr-x 1 root wheel 4194304 Dec 31 1600 $Bitmap -rwxr-xr-x 1 root wheel 8192 Oct 1 09:09 $Boot drwxr-xr-x 1 root wheel 0 Oct 1 09:09 $Extend -rwxr-xr-x 1 root wheel 67108864 Oct 1 09:09 $LogFile -rwxr-xr-x 1 root wheel 4096 Oct 1 09:09 $MFTMirr -rwxr-xr-x 1 root wheel 0 Dec 31 1600 $Secure -rwxr-xr-x 1 root wheel131072 Oct 1 09:09 $UpCase -rwxr-xr-x 1 root wheel 0 Oct 1 09:09 $Volume -rwxr-xr-x 1 root wheel 45124 Aug 18 2001 NTDETECT.COM drwxr-xr-x 1 root wheel 0 Oct 1 17:29 System Volume Information -rwxr-xr-x 1 root wheel 193 Oct 1 09:12 boot.ini -rwxr-xr-x 1 root wheel222368 Aug 18 2001 ntldr But I cannot mount /dev/da1s1 ~ sudo mount_ntfs /dev/da1s1 /mnt mount_ntfs: /dev/da1s1: Invalid argument Ok, and its not clear why/how mount_ntfs would be happy mounting da1 'raw' but it sure looks like (at least part of) an NTFS
Re: OT: fdisk
And still the wife doesn't suspect? On Mon, Oct 4, 2010 at 2:42 PM, Robert travelin...@cox.net wrote: On Tue, 5 Oct 2010 03:53:09 +1100 (EST) Ian Smith smi...@nimnet.asn.au wrote: Ian I am in the process of dd the entire disk to a 1TB disk but I wanted to respond to you. You have given a lot of good advice and information and I appreciate it. ~ fdisk /dev/da1 *** Working on device /dev/da1 *** parameters extracted from in-core disklabel are: cylinders=60801 heads=255 sectors/track=63 (16065 blks/cyl) Figures below won't work with BIOS for partitions not in cyl 1 parameters to be used for BIOS calculations are: cylinders=60801 heads=255 sectors/track=63 (16065 blks/cyl) Media sector size is 512 Warning: BIOS sector numbering starts with sector 1 Information from DOS bootblock is: The data for partition 1 is: sysid 7 (0x07),(NTFS, OS/2 HPFS, QNX-2 (16 bit) or Advanced UNIX) start 63, size 976773105 (476939 Meg), flag 0 beg: cyl 0/ head 1/ sector 1; end: cyl 1023/ head 15/ sector 63 The data for partition 2 is: UNUSED The data for partition 3 is: UNUSED The data for partition 4 is: UNUSED So pausing here for a bit .. starting at 63 (cyl 0/ head 1/ sector1 in CHS terms), looks correct for s1, one slice, whole disk for NTFS. That should rule out a damaged MBR in sector 0 - though it doesn't rule out the boot code in the first 2 or so sectors having been clobbered. I have tried earlier to explain what might/could have happened but was most likely not specific enough. I will try to do better. This was the wife's computer. It had Xp Pro on the first slice and FreeBSD 7.x on the second. Windows started acting strange and then was rebooting as soon as the desktop rendered. I booted to safe mode and went back one day in the recover option. Same thing happened, i.e. reboot after desktop rendered. I again booted in safe mode and went back two days. Could never get it to boot again even in safe mode. I booted into FreeBSD and copied some critical files off of the Windows slice that she was desperate to have. I put them on a pen drive so she could then access via her laptop. I checked the backup drive and saw that all was fine. I had the D$S stuff backing up nightly. I was able to mount either drive with _ntfs or ntfs-3g. No matter what I tried I could not get windows to boot even in safe mode. I left it running on FreeBSD aver night expecting to have to reinstall windows in the morning. The next day the system had rebooted with the GAG screen up. I ran memtest for about 6 hours and it showed a couple of faults. I pulled one of the three 512M memory chips and it seemed to run OK but still could not boot windows. I reinstalled windows and was doing all of the updates when it started failing to boot. Somewhere in that time the backup (500GB) drive became invisible to windows. FreeBSD showed only ad6 without the s1 partition. I used sade to look at it and it did not show as ntfs. I marked it as ntfs thinking that would fix it but it probably caused all of these problems. Whatever is wrong with that computer it now completely messed up. It will not even power on. I strapped out the power connect pins 3 and 4 and the PS runs and the voltages check out. You can often poke around the beginning of disks to advantage with say: # dd if=/dev/da1 bs=512 count=126 | hd | less to see the first two tracks .. sector 63 should be where NTFS starts, ie after sectors 0-62 on head 0. hd(1) skips repeated zeroes or 0xff and such, so you can hunt through quite a lot of early sectors without huge output in less, usually. Which looks a lot better. I can mount /dev/da1 and it shows Just to be clear, you mean: '# mount_ntfs /dev/da1 /mnt' ? (try to be sure to mount NTFS filesystems _explicitly_ read-only, especially if likely damaged) ~ ls -l /mnt total 70044 -rwxr-xr-x 1 root wheel 2560 Dec 31 1600 $AttrDef -rwxr-xr-x 1 root wheel 0 Oct 1 09:09 $BadClus -rwxr-xr-x 1 root wheel 4194304 Dec 31 1600 $Bitmap -rwxr-xr-x 1 root wheel 8192 Oct 1 09:09 $Boot drwxr-xr-x 1 root wheel 0 Oct 1 09:09 $Extend -rwxr-xr-x 1 root wheel 67108864 Oct 1 09:09 $LogFile -rwxr-xr-x 1 root wheel 4096 Oct 1 09:09 $MFTMirr -rwxr-xr-x 1 root wheel 0 Dec 31 1600 $Secure -rwxr-xr-x 1 root wheel131072 Oct 1 09:09 $UpCase -rwxr-xr-x 1 root wheel 0 Oct 1 09:09 $Volume -rwxr-xr-x 1 root wheel 45124 Aug 18 2001 NTDETECT.COM drwxr-xr-x 1 root wheel 0 Oct 1 17:29 System Volume Information -rwxr-xr-x 1 root wheel 193 Oct 1 09:12 boot.ini -rwxr-xr-x 1 root wheel222368 Aug 18 2001 ntldr But I cannot mount /dev/da1s1 ~ sudo mount_ntfs
Re: OT: fdisk
On Sat, Oct 2, 2010 at 9:45 PM, Robert travelin...@cox.net wrote: On Sat, 2 Oct 2010 19:09:27 -0600 (MDT) Warren Block wbl...@wonkity.com wrote: It's weird that da1 can be mounted, but da1s1 can't. Maybe a problem with the filesystem. Might be repairable, although probably it would need proprietary programs. Don't experiment with the original drive, make a copy with dd for experimenting. Warren I should have mentioned that before. dd was the first thing I tried. I had an unused drive setup as UFS. Then did dd if=/dev/da1s1 of=/dev/ad12s1d bs=1m count=2000 I believe that the above 'if' operand to dd should instead be /dev/da1 (without the 's1' slice). Also, the operand 'of' will need to point to a device, such as /dev/ad12, or a file on a mounted file system, such as /mnt/my_disk_image.img -Brandon ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: OT: fdisk
On Sun, 3 Oct 2010 01:15:06 -0500, Brandon Gooch jamesbrandongo...@gmail.com wrote: I believe that the above 'if' operand to dd should instead be /dev/da1 (without the 's1' slice). Also, the operand 'of' will need to point to a device, such as /dev/ad12, or a file on a mounted file system, such as /mnt/my_disk_image.img A good advice. Also: You should, when in doubt, never, NEVER operate on the disk you want to restore data from. Dump the whole disk into a file and operate on THAT file. Use mdconfig to make it a block device if needed. -- Polytropon Magdeburg, Germany Happy FreeBSD user since 4.0 Andra moi ennepe, Mousa, ... ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: OT: fdisk
On Sat, 2 Oct 2010 21:02:32 +0200, Patrick Lamaiziere patf...@davenulle.org wrote: Le Sat, 2 Oct 2010 11:36:40 -0700, Robert travelin...@cox.net a écrit : I tried to use dd and copy data to another spare drive. It appears to work but then I can no longer mount that drive. Other than taking it to a data recovery shop does anyone have any idea. May be photorec will help (in systutils/testdisk). http://www.cgsecurity.org/wiki/PhotoRec You don't need an expensive recovery shop - FreeBSD has many good tools for free. From my own experiences with data recovery, here's a short list of tools to keep in mind (yes, photorec is on that list, too - a very useful tool especially for use with SD and CF cards from cameras): System: dd - the very fist thing you use fsck_ffs- doesn't apply here as NTFS != UFS clri- as well, as further others may fsdb fetch -rR device recoverdisk Ports: ddrescue- if dd doesn't work dd_rescue - as well ffs2recov magicrescue testdisk photorec scan_ffs recoverjpeg foremost The Sleuth Kit: - if everything fails fls dls ils autopsy As I mentioned, work with copies only. If you have a disk big enough (disks aren't cheap today, your data isn't), make a copy of the copy and work with that. If you accidentally screw up the copy, delete it and make a new working copy from the master copy. Do not touch the original disk until you're done - and SURE about being done. If you fail to reconstruct the partition table, you can still get the bare data, even in form of separate files. Some of the recovery programs listed above are able to process input data where all partition and file system information is lost, i. e. they operate on byte level (blocks) and contain algorithms to determine files (begin, end, kind, magic). Allthough this work often results in the loss of file names and directory structures, the files theirselves come back. I've experienced a similar kind of data loss in the past, so I wish you good luck with recovery. For the future: Make backups. Lesson learned. :-) -- Polytropon Magdeburg, Germany Happy FreeBSD user since 4.0 Andra moi ennepe, Mousa, ... ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: OT: fdisk
On Sun, 3 Oct 2010, Brandon Gooch wrote: On Sat, Oct 2, 2010 at 9:45 PM, Robert travelin...@cox.net wrote: I should have mentioned that before. dd was the first thing I tried. I had an unused drive setup as UFS. Then did dd if=/dev/da1s1 of=/dev/ad12s1d bs=1m count=2000 I believe that the above 'if' operand to dd should instead be /dev/da1 (without the 's1' slice). Also, the operand 'of' will need to point to a device, such as /dev/ad12, or a file on a mounted file system, such as /mnt/my_disk_image.img Further, only the first 2G of a 500G NTFS filesystem will probably not be usable. A quick search found this (old) article: http://ixbtlabs.com/articles/ntfs/ ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: OT: fdisk
From owner-freebsd-questi...@freebsd.org Sat Oct 2 18:51:14 2010 Date: Sat, 2 Oct 2010 16:51:50 -0700 From: Robert travelin...@cox.net To: Warren Block wbl...@wonkity.com Cc: freebsd-questions@freebsd.org freebsd-questions@freebsd.org Subject: Re: OT: fdisk On Sat, 2 Oct 2010 17:00:00 -0600 (MDT) Warren Block wbl...@wonkity.com wrote: On Sat, 2 Oct 2010, Robert wrote: Greetings I am in deep with the wife. Her computer went belly up. It was running XP pro and I had backups going to a second drive. I can no longer access that drive. I pulled it and attached it via USB to one of my FreeBSD machines but it will not mount. It is a 500G hard drive and I get _wild_ results just looking at it with fdisk. ~ fdisk /dev/da1s1 *** Working on device /dev/da1s1 *** Wait a minute... shouldn't that be just da1? da1s1 is the first slice (partition), and the data there should be your XP filesystem, probably NTFS. Warren, You are right. Here it is: ~ fdisk /dev/da1 *** Working on device /dev/da1 *** parameters extracted from in-core disklabel are: cylinders=60801 heads=255 sectors/track=63 (16065 blks/cyl) Figures below won't work with BIOS for partitions not in cyl 1 parameters to be used for BIOS calculations are: cylinders=60801 heads=255 sectors/track=63 (16065 blks/cyl) Media sector size is 512 Warning: BIOS sector numbering starts with sector 1 Information from DOS bootblock is: The data for partition 1 is: sysid 7 (0x07),(NTFS, OS/2 HPFS, QNX-2 (16 bit) or Advanced UNIX) start 63, size 976773105 (476939 Meg), flag 0 beg: cyl 0/ head 1/ sector 1; end: cyl 1023/ head 15/ sector 63 The data for partition 2 is: UNUSED The data for partition 3 is: UNUSED The data for partition 4 is: UNUSED Which looks a lot better. I can mount /dev/da1 and it shows ~ ls -l /mnt total 70044 -rwxr-xr-x 1 root wheel 2560 Dec 31 1600 $AttrDef -rwxr-xr-x 1 root wheel 0 Oct 1 09:09 $BadClus -rwxr-xr-x 1 root wheel 4194304 Dec 31 1600 $Bitmap -rwxr-xr-x 1 root wheel 8192 Oct 1 09:09 $Boot drwxr-xr-x 1 root wheel 0 Oct 1 09:09 $Extend -rwxr-xr-x 1 root wheel 67108864 Oct 1 09:09 $LogFile -rwxr-xr-x 1 root wheel 4096 Oct 1 09:09 $MFTMirr -rwxr-xr-x 1 root wheel 0 Dec 31 1600 $Secure -rwxr-xr-x 1 root wheel131072 Oct 1 09:09 $UpCase -rwxr-xr-x 1 root wheel 0 Oct 1 09:09 $Volume -rwxr-xr-x 1 root wheel 45124 Aug 18 2001 NTDETECT.COM drwxr-xr-x 1 root wheel 0 Oct 1 17:29 System Volume Information -rwxr-xr-x 1 root wheel 193 Oct 1 09:12 boot.ini -rwxr-xr-x 1 root wheel222368 Aug 18 2001 ntldr But I cannot mount /dev/da1s1 ~ sudo mount_ntfs /dev/da1s1 /mnt mount_ntfs: /dev/da1s1: Invalid argument what does 'ls -l /dev/da1*' show? ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: OT: fdisk
On Sun, 3 Oct 2010 08:19:36 -0500 (CDT) Robert Bonomi bon...@mail.r-bonomi.com wrote: Which looks a lot better. I can mount /dev/da1 and it shows ~ ls -l /mnt total 70044 -rwxr-xr-x 1 root wheel 2560 Dec 31 1600 $AttrDef -rwxr-xr-x 1 root wheel 0 Oct 1 09:09 $BadClus -rwxr-xr-x 1 root wheel 4194304 Dec 31 1600 $Bitmap -rwxr-xr-x 1 root wheel 8192 Oct 1 09:09 $Boot drwxr-xr-x 1 root wheel 0 Oct 1 09:09 $Extend -rwxr-xr-x 1 root wheel 67108864 Oct 1 09:09 $LogFile -rwxr-xr-x 1 root wheel 4096 Oct 1 09:09 $MFTMirr -rwxr-xr-x 1 root wheel 0 Dec 31 1600 $Secure -rwxr-xr-x 1 root wheel131072 Oct 1 09:09 $UpCase -rwxr-xr-x 1 root wheel 0 Oct 1 09:09 $Volume -rwxr-xr-x 1 root wheel 45124 Aug 18 2001 NTDETECT.COM drwxr-xr-x 1 root wheel 0 Oct 1 17:29 System Volume Information -rwxr-xr-x 1 root wheel 193 Oct 1 09:12 boot.ini -rwxr-xr-x 1 root wheel222368 Aug 18 2001 ntldr But I cannot mount /dev/da1s1 ~ sudo mount_ntfs /dev/da1s1 /mnt mount_ntfs: /dev/da1s1: Invalid argument what does 'ls -l /dev/da1*' show? Robert Just what one might expect ~ ls -l /dev/da1* crw-rw 1 root operator0, 129 Oct 2 07:46 /dev/da1 crw-rw 1 root operator0, 92 Oct 2 16:43 /dev/da1s1 To all others who have answered: Thank you for all of your ideas. Warren, thanks for the link. I will be reading it and increasing my understanding of NTFS. I do not think there is anything physically wrong with the disk. I just cannot reach the data on it. Using photorec I have all files moved to a spare slice on this FreesBSD machine. It appears that there is less than 60G of actual data on the drive. Most of it is not needed so it will take quite awhile to sort the wanted from the unwanted. I have a spare 250G hard drive. Can I use dd to capture 250 gigs from the old drive? Using da1 and ad12 as the if and of will the result be an NTFS formatted 250g drive? Will I have the same results, i.e. able to mount ad12 but not ad12s1? Should I zero out the 250g drive first? Can ddrescue do a better job? This drive was used for a backup of of the DocsSets folders of the XP drive. It also had music and photo files that are also on the FreeBSD computer so they are not that critical. The DocsSets folders are the most important to recover so if I can access the data, I can burn it to DVD. Thanks again to all who have responded. Robert ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: OT: fdisk
On Sun, 3 Oct 2010 10:00:51 -0700, Robert travelin...@cox.net wrote: I have a spare 250G hard drive. Can I use dd to capture 250 gigs from the old drive? Using da1 and ad12 as the if and of will the result be an NTFS formatted 250g drive? Will I have the same results, i.e. able to mount ad12 but not ad12s1? Yes, as dd gives you an 1:1 copy of what you have. If you intend to experiment on the partition (which means that you don't just do reading operations, but writing operations, too), and you're using FreeBSD for that, simply use dd's of= parameter to write to a file instead of directly to the partition; format the ad12 disk with UFS for that purpose. Should I zero out the 250g drive first? No need, as dd should overwrite anything. Can ddrescue do a better job? The ddrescue program has the ability to adjust reading block size dynamically if reading errors occur. As you said, the disk itself seems to be fine, so no job for ddrescue here. The DocsSets folders are the most important to recover so if I can access the data, I can burn it to DVD. If everything fails, use The Sleuth Kit; after installing it, read /usr/local/share/doc/sleuthkit/skins_ntfs.txt for more information. -- Polytropon Magdeburg, Germany Happy FreeBSD user since 4.0 Andra moi ennepe, Mousa, ... ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: OT: fdisk
On Sun, 3 Oct 2010 19:40:45 +0200 Polytropon free...@edvax.de wrote: On Sun, 3 Oct 2010 10:00:51 -0700, Robert travelin...@cox.net wrote: I have a spare 250G hard drive. Can I use dd to capture 250 gigs from the old drive? Using da1 and ad12 as the if and of will the result be an NTFS formatted 250g drive? Will I have the same results, i.e. able to mount ad12 but not ad12s1? Yes, as dd gives you an 1:1 copy of what you have. If you intend to experiment on the partition (which means that you don't just do reading operations, but writing operations, too), and you're using FreeBSD for that, simply use dd's of= parameter to write to a file instead of directly to the partition; format the ad12 disk with UFS for that purpose. Polytropon Thanks for the info. I successfully did the above and now I have a 58.6GB file named disk.img on a UFS disk. Umm, what should I do now. Sorry for dumb question number 37 this weekend but I am a bit confused. Can I do just the opposite to another NTFS drive and end up with all the data looking like it should? I.E. dd from the file to an NTFS disk. Robert ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: OT: fdisk
On Sun, 3 Oct 2010, Polytropon wrote: On Sun, 3 Oct 2010 10:00:51 -0700, Robert travelin...@cox.net wrote: I have a spare 250G hard drive. Can I use dd to capture 250 gigs from the old drive? Using da1 and ad12 as the if and of will the result be an NTFS formatted 250g drive? Will I have the same results, i.e. able to mount ad12 but not ad12s1? Yes, as dd gives you an 1:1 copy of what you have. It will give an exact copy of the first 250G, which also means it will not resize the 500G filesystem into a working 250G version. The first step would be a copy of the entire drive. Then the filesystem can be repaired and resized. ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
OT: fdisk
Greetings I am in deep with the wife. Her computer went belly up. It was running XP pro and I had backups going to a second drive. I can no longer access that drive. I pulled it and attached it via USB to one of my FreeBSD machines but it will not mount. It is a 500G hard drive and I get _wild_ results just looking at it with fdisk. ~ fdisk /dev/da1s1 *** Working on device /dev/da1s1 *** parameters extracted from in-core disklabel are: cylinders=60801 heads=255 sectors/track=63 (16065 blks/cyl) Figures below won't work with BIOS for partitions not in cyl 1 parameters to be used for BIOS calculations are: cylinders=60801 heads=255 sectors/track=63 (16065 blks/cyl) Media sector size is 512 Warning: BIOS sector numbering starts with sector 1 Information from DOS bootblock is: The data for partition 1 is: sysid 114 (0x72),(unknown) start 218129509, size 1701990410 (831050 Meg), flag 63 beg: cyl 368/ head 111/ sector 45; end: cyl 371/ head 101/ sector 51 The data for partition 2 is: sysid 116 (0x74),(unknown) start 729050177, size 543974724 (265612 Meg), flag 73 beg: cyl 67/ head 115/ sector 32; end: cyl 299/ head 114/ sector 44 The data for partition 3 is: sysid 101 (0x65),(Novell Netware/386 3.xx) start 168653938, size 0 (0 Meg), flag 74 beg: cyl 114/ head 111/ sector 32; end: cyl 353/ head 115/ sector 52 The data for partition 4 is: sysid 0 (),(unused) start 2692939776, size 51635 (25 Meg), flag 0 beg: cyl 0/ head 0/ sector 0; end: cyl 0/ head 0/ sector 0 I tried to use dd and copy data to another spare drive. It appears to work but then I can no longer mount that drive. Other than taking it to a data recovery shop does anyone have any idea. I haven't told her that her data is lost yet. I may have to wait until we are drinking a bottle of wine. :-) Thanks for any suggestions. Robert ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: OT: fdisk
Le Sat, 2 Oct 2010 11:36:40 -0700, Robert travelin...@cox.net a écrit : I tried to use dd and copy data to another spare drive. It appears to work but then I can no longer mount that drive. Other than taking it to a data recovery shop does anyone have any idea. May be photorec will help (in systutils/testdisk). http://www.cgsecurity.org/wiki/PhotoRec Good luck! ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: OT: fdisk
On Sat, 2 Oct 2010 11:36:40 -0700 Robert travelin...@cox.net articulated: I am in deep with the wife. Her computer went belly up. It was running XP pro and I had backups going to a second drive. I can no longer access that drive. If the disk is the problem, I would suggest getting a copy of Spin-Rite http://www.grc.com/spinrite.htm and running it at level 6 maximum. It is the best disk recovery program I have come across. -- Jerry ✌ freebsd.u...@seibercom.net Disclaimer: off-list followups get on-list replies or get ignored. Please do not ignore the Reply-To header. __ History books which contain no lies are extremely dull. ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: OT: fdisk
On 02.10.2010 21:08, Jerry wrote: On Sat, 2 Oct 2010 11:36:40 -0700 Robert travelin...@cox.net articulated: I am in deep with the wife. Her computer went belly up. It was running XP pro and I had backups going to a second drive. I can no longer access that drive. If the disk is the problem, I would suggest getting a copy of Spin-Rite http://www.grc.com/spinrite.htm and running it at level 6 maximum. It is the best disk recovery program I have come across. +1 to that. I've been using spinrite for more than a decade, and have lost count of the times it has saved data for me (or rather: For people dumping their crashed pc in my lap, since _I_ have _BACKUPS_). When you're done recovering data, you might want to take a look at your backup strategy. Select a new one that doesn't depend on spinning metal just as fragile as the one you're backing up from. //Svein -- +---+--- /\ |Svein Skogen | sv...@d80.iso100.no \ / |Solberg Østli 9| PGP Key: 0xE5E76831 X|2020 Skedsmokorset | sv...@jernhuset.no / \ |Norway | PGP Key: 0xCE96CE13 | | sv...@stillbilde.net ascii | | PGP Key: 0x58CD33B6 ribbon |System Admin | svein-listm...@stillbilde.net Campaign|stillbilde.net | PGP Key: 0x22D494A4 +---+--- |msn messenger: | Mobile Phone: +47 907 03 575 |sv...@jernhuset.no | RIPE handle:SS16503-RIPE +---+--- If you really are in a hurry, mail me at svein-mob...@stillbilde.net This mailbox goes directly to my cellphone and is checked even when I'm not in front of my computer. Picture Gallery: https://gallery.stillbilde.net/v/svein/ signature.asc Description: OpenPGP digital signature
Re: OT: fdisk
On Sat, 2 Oct 2010, Robert wrote: Greetings I am in deep with the wife. Her computer went belly up. It was running XP pro and I had backups going to a second drive. I can no longer access that drive. I pulled it and attached it via USB to one of my FreeBSD machines but it will not mount. It is a 500G hard drive and I get _wild_ results just looking at it with fdisk. ~ fdisk /dev/da1s1 *** Working on device /dev/da1s1 *** Wait a minute... shouldn't that be just da1? da1s1 is the first slice (partition), and the data there should be your XP filesystem, probably NTFS. ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: OT: fdisk
On Sat, 2 Oct 2010 17:00:00 -0600 (MDT) Warren Block wbl...@wonkity.com wrote: On Sat, 2 Oct 2010, Robert wrote: Greetings I am in deep with the wife. Her computer went belly up. It was running XP pro and I had backups going to a second drive. I can no longer access that drive. I pulled it and attached it via USB to one of my FreeBSD machines but it will not mount. It is a 500G hard drive and I get _wild_ results just looking at it with fdisk. ~ fdisk /dev/da1s1 *** Working on device /dev/da1s1 *** Wait a minute... shouldn't that be just da1? da1s1 is the first slice (partition), and the data there should be your XP filesystem, probably NTFS. Warren, You are right. Here it is: ~ fdisk /dev/da1 *** Working on device /dev/da1 *** parameters extracted from in-core disklabel are: cylinders=60801 heads=255 sectors/track=63 (16065 blks/cyl) Figures below won't work with BIOS for partitions not in cyl 1 parameters to be used for BIOS calculations are: cylinders=60801 heads=255 sectors/track=63 (16065 blks/cyl) Media sector size is 512 Warning: BIOS sector numbering starts with sector 1 Information from DOS bootblock is: The data for partition 1 is: sysid 7 (0x07),(NTFS, OS/2 HPFS, QNX-2 (16 bit) or Advanced UNIX) start 63, size 976773105 (476939 Meg), flag 0 beg: cyl 0/ head 1/ sector 1; end: cyl 1023/ head 15/ sector 63 The data for partition 2 is: UNUSED The data for partition 3 is: UNUSED The data for partition 4 is: UNUSED Which looks a lot better. I can mount /dev/da1 and it shows ~ ls -l /mnt total 70044 -rwxr-xr-x 1 root wheel 2560 Dec 31 1600 $AttrDef -rwxr-xr-x 1 root wheel 0 Oct 1 09:09 $BadClus -rwxr-xr-x 1 root wheel 4194304 Dec 31 1600 $Bitmap -rwxr-xr-x 1 root wheel 8192 Oct 1 09:09 $Boot drwxr-xr-x 1 root wheel 0 Oct 1 09:09 $Extend -rwxr-xr-x 1 root wheel 67108864 Oct 1 09:09 $LogFile -rwxr-xr-x 1 root wheel 4096 Oct 1 09:09 $MFTMirr -rwxr-xr-x 1 root wheel 0 Dec 31 1600 $Secure -rwxr-xr-x 1 root wheel131072 Oct 1 09:09 $UpCase -rwxr-xr-x 1 root wheel 0 Oct 1 09:09 $Volume -rwxr-xr-x 1 root wheel 45124 Aug 18 2001 NTDETECT.COM drwxr-xr-x 1 root wheel 0 Oct 1 17:29 System Volume Information -rwxr-xr-x 1 root wheel 193 Oct 1 09:12 boot.ini -rwxr-xr-x 1 root wheel222368 Aug 18 2001 ntldr But I cannot mount /dev/da1s1 ~ sudo mount_ntfs /dev/da1s1 /mnt mount_ntfs: /dev/da1s1: Invalid argument Patrick wrote May be photorec will help (in systutils/testdisk). http://www.cgsecurity.org/wiki/PhotoRec I installed this and can successfully recover the date to a spare slice. The problem is the data is all over the place. There is a ton if png files from her playing games on facebook. This can be better than nothing because I can go through the files and move/rename the ones we want to keep. Thank you both. I am willing to try any other suggestions. It appears the the motherboard went gradually bad and hosed up this drive. Robert ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: OT: fdisk
On Sat, 2 Oct 2010, Robert wrote: But I cannot mount /dev/da1s1 ~ sudo mount_ntfs /dev/da1s1 /mnt mount_ntfs: /dev/da1s1: Invalid argument It's weird that da1 can be mounted, but da1s1 can't. Maybe a problem with the filesystem. Might be repairable, although probably it would need proprietary programs. Don't experiment with the original drive, make a copy with dd for experimenting. ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: OT: fdisk
On Sat, 2 Oct 2010 19:09:27 -0600 (MDT) Warren Block wbl...@wonkity.com wrote: It's weird that da1 can be mounted, but da1s1 can't. Maybe a problem with the filesystem. Might be repairable, although probably it would need proprietary programs. Don't experiment with the original drive, make a copy with dd for experimenting. Warren I should have mentioned that before. dd was the first thing I tried. I had an unused drive setup as UFS. Then did dd if=/dev/da1s1 of=/dev/ad12s1d bs=1m count=2000 thinking I could try the first two gigabytes and then go from there. It look like it went fine but then I could not mount the ad12s1d partition. It was able to mount it previously. Going back even further, When I first realized there was a problem with this drive, I booted with 8.1 livefs. The drive had lost it's id that showed it was NTFS. I used sade and marked it as NTFS but was never able to mount it. It is very possible that I messed it up but I was having all sorts of problems with that computer and XP pro doesn't exactly help one out. Thanks again for your time. Robert ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
