On Tue, 28 Jan 2014 21:32:05 +0100 Per Jessen wrote:

Stephen Berman wrote:

...

An external hard disk of mine became corrupted, and in an effort to save the data on it I dd'd it to another hard disk. Both disks were formatted in Yast (openSUSE 13.1) with a single ext4 partition. But after using dd, now the filesystem is gone from the second disk,

Yes, you've created a copy of the corrupted disk.

I feared as much. Is there any way to save the data (including the filesystem) from a corrupted partition (aside from already having a backup of it)? Steve Berman -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Tue, 28 Jan 2014 15:49:38 -0500 Patrick Shanahan wrote:

* Stephen Berman [01-28-14 15:46]:

...

On Tue, 28 Jan 2014 21:32:05 +0100 Per Jessen wrote:

...

Stephen Berman wrote:

...

An external hard disk of mine became corrupted, and in an effort to save the data on it I dd'd it to another hard disk. Both disks were formatted in Yast (openSUSE 13.1) with a single ext4 partition. But after using dd, now the filesystem is gone from the second disk,

Yes, you've created a copy of the corrupted disk.

I feared as much. Is there any way to save the data (including the filesystem) from a corrupted partition (aside from already having a backup of it)?

I tried ddrescue on a faulty win7 laptop w/o success and found it a lengthy process time wise.

That doesn't sound very encouraging... Steve Berman -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2014-01-28 21:44, Stephen Berman wrote:

On Tue, 28 Jan 2014 21:32:05 +0100 Per Jessen <> wrote:

...

Yes, you've created a copy of the corrupted disk.

I feared as much. Is there any way to save the data (including the filesystem) from a corrupted partition (aside from already having a backup of it)?

You could try testdisk and photorec. -- Cheers / Saludos, Carlos E. R. (from 12.3 x86_64 "Dartmouth" at Telcontar)

On 2014-01-28 22:39, Stephen Berman wrote:

On Tue, 28 Jan 2014 22:20:39 +0100 "Carlos E. R." <> wrote:

...

You could try testdisk and photorec.

I have tried testdisk on the original corrupted disk and was unable to restore the filesystem with it, so I'm hesitant to try it on the second, hopefully non-corrupted, disk, but maybe it's worth a try...

The other disk is equally corrupted. It is a dd copy, so they are the same bit by bit. -- Cheers / Saludos, Carlos E. R. (from 12.3 x86_64 "Dartmouth" at Telcontar)

* Rolf Muth [01-28-14 16:59]:

Am Dienstag 28 Januar 14 schrieb Stephen Berman:

...

On Tue, 28 Jan 2014 21:32:05 +0100 Per Jessen wrote:

...

Stephen Berman wrote:

...

An external hard disk of mine became corrupted, and in an effort to save the data on it I dd'd it to another hard disk. Both disks were formatted in Yast (openSUSE 13.1) with a single ext4 partition. But after using dd, now the filesystem is gone from the second disk,

Yes, you've created a copy of the corrupted disk.

I feared as much. Is there any way to save the data (including the filesystem) from a corrupted partition (aside from already having a backup of it)?

Steve Berman

foremost foremost.sourceforge.net/ http://en.wikipedia.org/wiki/Foremost_(software)

http://software.opensuse.org/package/foremost?search_term=foremost -- (paka)Patrick Shanahan Plainfield, Indiana, USA @ptilopteri http://en.opensuse.org openSUSE Community Member facebook/ptilopteri http://wahoo.no-ip.org Photo Album: http://wahoo.no-ip.org/gallery2 Registered Linux User #207535 @ http://linuxcounter.net -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2014-01-28 22:48, jdd wrote: the two disks

are of similar size, your new disk is gone forever...

Not for ever. At worst (disk clone) your have to repartition it. If it was a partition clone, you just format that partition again. -- Cheers / Saludos, Carlos E. R. (from 12.3 x86_64 "Dartmouth" at Telcontar)

Steve -- ...and then Stephen Berman said... % ... % nothing basis. Both the corrupted disk and the good disk that I dd'd % the data to are 3TB external disks, and I don't have that much space on % my other disks, so until I replace the corrupted disk I can't try to % recover all the data in one go. 1) Don't replace it yet; supplement with the replacement for the recovery before getting rid of the sicko. 0) Good luck :-)/2 I've been there! % % Steve Berman HAND :-D -- David T-G See http://justpickone.org/davidtg/email/ See http://justpickone.org/davidtg/tofu.txt

On Thu, Jan 30, 2014 at 11:19 AM, Stephen Berman wrote:

On Tue, 28 Jan 2014 23:31:42 -0500 Greg Freemyer wrote:

...

Stephen Berman wrote:

...

An external hard disk of mine became corrupted, and in an effort to save the data on it I dd'd it to another hard disk. Both disks were formatted in Yast (openSUSE 13.1) with a single ext4 partition. But after using dd, now the filesystem is gone from the second disk, though otherwise the partition table appears to be intact, and cat and grep show at least some of the data. I had run `e2fsck -b 32768 -c' on the first disk when the problem first appeared (it was unmountable), but that seemed to make things worse, so I'm reluctant to try it on the second disk, unless someone convinces me I used it wrong and tells me the right way. Or is there another way to restore the filesystem without losing the data?

Steve Berman

Most if not all of the recommendations were disk recovery tools or file carvers.

Both have their use, but your disk seems fine and file carving is a last resort.

Why is that?

A file carver, such as foremost, testdisk, photrec works by scanning all sectors looking for recognizable file headers. Once they find that, they do a linear scan of the drive in an effort to find the end of the file. In many cases, they just guess. Note, that because they are not looking a filesystem metadata at all, they have these major shortcomings: - They never recover the filename since that is maintained in the directory metadata, not in the file itself - They make no effort to recover the path information - They make no effort to recover fragmented files - They can only recover files that have well-defined header signatures and which have a well defined way to know where the end of the file is. Now, if the corrupted disk is full of photos from a camera, the above limitations may not be a problem. Lots of files are actually not fragmented and for cameras the path and filename info isn't all that important in the first place. Further JPEGs have a well defined header and you can determine how long file is from context inside the JPEG. That's why so many people have absolutely great success recovering photo's from camera media via photorec. Your case doesn't seem to one that would work well with a data carver.

...

The best option for your case is a scanner that understands ext4 directory/inside style metadata and uses it to pull out files with accurate names and even paths.

I've got commercial software that does that. The only open source app for that I know is ext4magic

http://software.opensuse.org/search?q=ext4magic

I packaged it, but I only did minimal testing. I don't know why someone else packaged the older version, but you can try it out too.

As far as I understood from the man page, this is for recovering deleted files from an intact ext4 filesystem. But my case is the opposite: the data is there, but the filesystem is gone (or anyway unrecognizable).

From the projects home page http://openfacts2.berlios.de/wikien/index.php/BerliosProject:Ext4magic summary section

"includes functions tries to recover a partially destroyed file system." I can only assume that is what you have (ie. a partially destroyed file system). fyi: If you speak German, the author of ext4magic recommends http://openfacts2.berlios.de/wikide/index.php/BerliosProject:Ext4magic as having more documentation than the english version.

In any case, as far as I could tell both ext4magic and foremost (the file carving tool also recommended) work essentially on an all or nothing basis. Both the corrupted disk and the good disk that I dd'd the data to are 3TB external disks, and I don't have that much space on my other disks, so until I replace the corrupted disk I can't try to recover all the data in one go.

The dd copy you made seemed to complete with no errors. That's great, but now you effectively have 2 identical copies of the corrupted filesystem. You either need to invest some money and buy a 3rd 3TB drive, or re-format the drive with the second copy you made and use the drive to hold the output of ext4magic and/or foremost run against the original drive. So the question at hand relates to the value of the data on the drive. It is valuable, I would buy a 3rd drive. If it is nice to have, then trash the second copy and proceed with trying to pull good data out of the original. The one thing you don't want to do is write to the original. Don't even try to mount it. Tools like ext4magic and foremost are designed to work with the ram filesystem, not with a mounted version of it.

Steve Berman

Greg -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Thu, Jan 30, 2014 at 1:23 PM, Anton Aylward wrote:

On 01/30/2014 01:12 PM, Greg Freemyer wrote:

...

A file carver, such as foremost, testdisk, photrec works by scanning all sectors looking for recognizable file headers.

Once they find that, they do a linear scan of the drive in an effort to find the end of the file. In many cases, they just guess.

What about a disk with a LVM partition? Suppose the partition table gets destroyed ... Isn't the information about the LVM 'portable' and well contained? Can't it say "There's the file system ..."

I don't think so. If you set /dev/sda1 and /sdb2 to be the physical members of a LVM setup, then LVM maintains the location of the logical volumes it creates relative to the start of sda1 and sdb2. If you lose your partition table, LVM will no longer know where sda1 and sdb2 are, so it's relative information is useless. Now, recreating partition tables is not necessarily hard. I've used gpart a couple times to do that with great success. Greg -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Thu, Jan 30, 2014 at 1:53 PM, Anton Aylward wrote:

On 01/30/2014 01:35 PM, Greg Freemyer wrote:

...

On Thu, Jan 30, 2014 at 1:23 PM, Anton Aylward wrote:

...

On 01/30/2014 01:12 PM, Greg Freemyer wrote:

...

A file carver, such as foremost, testdisk, photrec works by scanning all sectors looking for recognizable file headers.

Once they find that, they do a linear scan of the drive in an effort to find the end of the file. In many cases, they just guess.

What about a disk with a LVM partition? Suppose the partition table gets destroyed ... Isn't the information about the LVM 'portable' and well contained? Can't it say "There's the file system ..."

I don't think so.

If you set /dev/sda1 and /sdb2 to be the physical members of a LVM setup, then LVM maintains the location of the logical volumes it creates relative to the start of sda1 and sdb2.

If you lose your partition table, LVM will no longer know where sda1 and sdb2 are, so it's relative information is useless.

Now, recreating partition tables is not necessarily hard. I've used gpart a couple times to do that with great success.

Let me ask that a different way.

I realise that LVM headers are text so they can be seen if do a 'strings' on the whole disk ... So they make the poster-boy here, but surely other file systems have clear headers as well.

Isn't there a scanner/tool which can look for these and help you rebuild the partition table or whatever?

Yes, that is why I talked about gpart. It is a drive scanner that looks for filesystem headers and rebuilds partition tables. I don't know if gpart has LVM support, but if it doesn't it should not be hard to add. gpart is in the distro, so zypper in gpart to experiment with it. === From https://build.opensuse.org/package/show/openSUSE:13.1/gpart Gpart is a small tool that tries to guess what partitions are on a PC type hard disk in case the primary partition table was damaged. Gpart supports, among others, partitions formatted as ext2, FAT 12/16/32, ReiserFS, NTFS, and HPFS. Read the file /usr/share/doc/packages/gpart/README and the gpart man page before using gpart. === I repeat I've use gpart to good effect in the past. iirc, I ran it in a test mode until I was comfortable it was recreating the right partition info, then I had it update the actual partition table. Knowing me, I'm sure I made a backup of the corrupt partition table before overwriting it. Greg -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org