drive lost all 4 partitions during power off on early boot stage

wolfdogg · 2013-09-30 21:06:16

Well, it seems i have my share of drive problems lately. now my main system drive took a dive off the deepend, and i dont know why. It was booting fine, then after whatever caused it the partition table is gone.

main problem is, ALL my local web development work was on this drive, including old .git and svn repositories, and the snapshot backup of those, along with all /etc, and /home was temporarily on there while i work on my other drives. data loss is rearing its ugly head once again. its been about 10 years for me, and i swore that i would do everyting in my power to keep that from happening again.

the nearest i can figure is i made a huge mistake when powering off the system when trying to boot a boot cd, just after the intial stages of boot was occurring, and i thought i saw the ("mounting /" blah blah), when i let out a big expletive just as the power cycled off after the standard 4 second delay of the pc's power button. i realized that it was booting the wrong drive, so i needed to power cycle it, but i did it a few seconds too late.

the drive is a standard arch linux 4 partition system drive, including /, /boot, /home, swap. boot and home are ext3. i cant tell you at this moment if the partition table is GPT, or MBR. I can tell you after Test Disk finishes running.

1) On initial run, test disk didnt find ANYTHING, and when i selected "Load Backup" that didnt find anything either, even on a "Deeper Scan"
2) gparted gui shows nothing

3) running another tool on Hirens shows something like this, zeroed out!
0:0 0 0 0 0 0 0 0 0 0
1:0 0 0 0 0 0 0 0 0 0
2:0 0 0 0 0 0 0 0 0 0
3:0 0 0 0 0 0 0 0 0 0
i would have suspected this is 4 partitions, but when i check my other drives i see data in the 0: entry only, and the 1:, 2:, 3: entries are also there, but blank. so i guess those are not partitions.

how can a hard drive get its entire partition table erased in this fashion?

any specific tools that i should be using to test partition table, recover partition table, backup partition table?

EDIT: i added a 3rd entry to the list

Last edited by wolfdogg (2013-09-30 21:59:49)

Pse · 2013-09-30 21:53:35

First, if you have enough space somewhere else [1], do a complete image of the drive. Then attempt a partition table recovery with GParted. If that fails, you will need to use tools to scan the drive for the first block of each partition you want to rescue. There might be tools for that, though I cannot name any from the top of my head.

If you cannot do an image of the drive, then I would not try any fixes that write to the disk until I can get my data off of it.

Edit: [1] buying a new hard drive to use as a backup might be a good idea. You can but it now, and use it temporarily for the image.

Last edited by Pse (2013-09-30 21:54:53)

cfr · 2013-09-30 22:03:41

Definitely image it and work on the image - not the original.

Whether it is MBR or GPT may matter. GPT includes a backup copy of the partition table which may be used for recovery.

I guess you've read https://wiki.archlinux.org/index.php/Data_rescue?

ewaller · 2013-09-30 22:15:17

Wolfdog. Take a break. Go outside and get some fresh air, then come back inside and be methodical.

I'll bet you have multiple drives and that, for whatever reason, you are not talking to the one you think you are. Even if you are not, I think you need to walk away and come back when composed.

wolfdogg · 2013-09-30 22:17:27

great suggestion, take a load off my chest that i didnt even know was there, :-) i have a drive i can back it up to, and will do so right now. any suggestion on the tool to clone with? There is so many tools in Hirens boot cd that im starting to love this disc, i see in the backup tools "Ghost 4 Linux" see this article http://en.alexnogard.com/g4l-ghost-4-li … artitions/ im going to try that one to start with and see how it goes.

My first thought was if i do this, can i try to recover the partitions on the drive i copied to? or maybe build them, until they work? is that an option?

cfr · 2013-09-30 23:03:12

I think ewaller probably had more than 130 seconds of break in mind... .

ddrescue is supposed to be very good, especially at retrying and trying in multiple ways.

Pse · 2013-09-30 23:59:02

wolfdogg wrote:

My first thought was if i do this, can i try to recover the partitions on the drive i copied to? or maybe build them, until they work? is that an option?

Yes, if you have an exact copy of the disk, you should be able to work on the backup.

cfr · 2013-10-01 00:24:33

ewaller wrote:

I'll bet you have multiple drives and that, for whatever reason, you are not talking to the one you think you are.

Have you fully considered this possibility?

wolfdogg · 2013-10-01 01:46:29

lol, i didnt even see his message when i was composing that one, hehehe. its rainy outside, but i was doing some google mapping for a planned expedition coming up, so that got my mind off things, i was waiting for the image to complete. its now compltee. i think im going to run outside and mow the lawn since it hasnt rained since this morning, we got a bit of sun, and there will be rain for the next 3 months, so gotta do it while i can.

copy process executed succesfully, i used disk copy 2.3, took 3 hours, copied size 232.88GB, no read or write errors. ill com eback later in and read over this post, reply, and do some work. thanks!!!

wolfdogg · 2013-10-01 02:37:25

i know im talking to the right drive, i only have one 250gb, i have definitely considered that. the others are 750gb, 750gb, 2tb, 500gb. all those show up with a partition table from test disk as well, it was only the 250 that didnt, plus i had all other drives disconnected at first when i was trying to boot to isolate out any other causes. for now, i have backed it up to the 2tb. im going to work on it there. im so happy to have it backed up, i cant thank you enough for that suggestion, since im my pea sized brain i was thinking my only option was to recover it, since i didnt see any data there.

im now ready to recover the partition using the 2tb drive that i copied it to, i will start with gdisk and take a look into it(just to check to see what it reads, nothing more, then i will try using ddrescue to see what it can find. Brings me to a question, when you do a sector by sector copy, does that mean the mbr/gpt was copied over too? because i had a gpt on the 2tb before copying onto it, and im still not sure what type the 250gb has.

Last edited by wolfdogg (2013-10-01 02:40:07)

wolfdogg · 2013-10-01 06:14:57

ok so i ran disk copy first, as mentioned, and i kinda thought ddrescue was to rescue the files, but i see mainly its for imaging, i didnt figure that out until i was already 1/3rd of the way through the process. i ran parted magic, which is a desktop, then from the ternimal i am running ddrescue. after running ddrescue -v it appears that this is the better of the two, Gnu's gddrescue. A luck shot there, having not known about this before i started.

I now know the original drive was using a MBR (/dev/sda 250gb)
the commands i ran are as follows

//EaseUs Disk Copy 2.3 i used to copy the drive sector by sector, why i used this i dont know, i just like the idea of a sector
// by sector copy, i copied the initial drive (/dev/sda 250gb with MBR) to (/dev/sdd 750gb GPT) 

//gdisk to partition a new backup drive (/dev/sdc GPT)

//make filesystem on this drive
# mkfs ext3 /dev/sdc1 (all 750gb)
# mount /dev/sdc1 /mnt/local/sdc 

//run ddrescue on the copied disk (/dev/sdd) and image it to (/dev/sdc) not sure why i did this, but since i already copied the
// data to /dev/sdd i would rather not wear out /dev/sda at the moment. 
# ddrescue -r 7 /dev/sdd /mnt/local/sdc/250.img /mnt/local/sdc/250.txt

so far its 150gb into the backup, and no errors yet.

did i do anything wrong so far? i know i should have used ddrescue in teh first place to copy /dev/sda to /dev/sdd and i would have been done with that step already, but thats hindsight. how about the -r 7, is that overkill, should i run different options instead?

also, am i supposed to be recovering files, or trying to recover teh partitions with this new image i just created with ddrescue after mounting it?

Last edited by wolfdogg (2013-10-01 06:19:09)

wolfdogg · 2013-10-01 08:02:10

ok i had to stop the ddrescue after it got to 270 some odd gigabytes as i realized it was going to take the entire 2tb, atleast i thought it would, and try to put that onto the 750gb drive which is not going to fit. so i figured that was enough data. afterall i still have the log available if i need to start it from where i left off.
i followed this https://wiki.archlinux.org/index.php/Fi … isk_Images

# losetup -f -P /mnt/local/sdc/250.img

then i looked into /dev at the loop devices and noticed by the timestamp that the only loop device that was timestamped when i ran the command was loop2. its the only one, the rest of the 255 loop devices i see are all created when i loaded gparted i believe. when i looked into /mnt/local/250 its completely empty, no partition, no files. does this mean that only empty data was copied? thats a scary thought.

when i try to mount the loop device

# mkdir /mnt/temp
# mount /dev/loop2 /mnt/temp

i get the obvious error

mount: wrong fs type, bad option, bad superblock on /dev/loop2, missing codepage or helper program, or othe error.

no helpful message in dmesg either.

then i tried to follow some of the procedures on this page https://help.ubuntu.com/community/DataR … 6c0a2e94fb but i realize that without one drive image / no partitions, i cant really do anything at the moment.

im wondering if i should just now run ddrescue again, and create a new image, but this time run it on the original drive that lost its partitions (/dev/sda) is this my next step, to see if i can get some data out of it, or do i need to use some other tools now on the 250.img that was extracted from /mnt/local/sdc?

note, foremost, and e2sfsck are not available on parted magic i found. so if i need them ill have to download them and compile them on there. however 'make' is not on there either. should i install another distribution other than parted magic to be doing all these operations under? such as arch, on another drive?

Last edited by wolfdogg (2013-10-01 08:21:34)

Pse · 2013-10-01 15:26:05

I'd be using the GParted live-CD, a custom Arch install with only what I need, or a Ubuntu or Fedora live-CD.
I don't know much about the tools you used, but if the drive with the data you want to rescue does not have bad sectors, this is what I'd do to image it:

dd if=/dev/sdX of=/mnt/mounted-drive-with-enough-space/home/user/250.img bs=1M

Then you can work on the image. If you had an MBR in it, you can try to run fdisk. There's no need for a loop device yet:

fdisk -l /mnt/mounted-drive-with-enough-space/home/user/250.img

The hard part is either restoring the partition table, or finding the offsets for each partition. I'd probably ask for help in the mailing list/irc channel of the filesystem you were using for each partition. They'd probably know best how to find the first block of each partition.

When you know where the partition starts, you can then use a loop device and run whatever tools you like on it. To set up the loop device use:

losetup --find --show --offset <offset-of-partition> --sizelimit <size-of-partition> /mnt/mounted-drive-with-enough-space/home/user/250.img

vacant · 2013-10-01 15:37:03

wolfdogg wrote:

3) running another tool on Hirens shows something like this, zeroed out!
0:0 0 0 0 0 0 0 0 0 0
1:0 0 0 0 0 0 0 0 0 0
2:0 0 0 0 0 0 0 0 0 0
3:0 0 0 0 0 0 0 0 0 0
i would have suspected this is 4 partitions, but when i check my other drives i see data in the 0: entry only, and the 1:, 2:, 3: entries are also there, but blank. so i guess those are not partitions.

how can a hard drive get its entire partition table erased in this fashion?

What does smartctl say about the drive (and your other drives)?
How is the motherboard, drive pins, cables, all nice and tight?
Could you have been hacked?

cfr · 2013-10-01 21:09:15

Pse wrote:

I don't know much about the tools you used, but if the drive with the data you want to rescue does not have bad sectors, this is what I'd do to image it:
dd if=/dev/sdX of=/mnt/mounted-drive-with-enough-space/home/user/250.img bs=1M

I'd probably do this with ddrescue. Certainly if dd ran into problems but I'd probably start with ddrescue in case I ran out of time to run a second programme. (But ddrescue will take longer so time could go the other way.)

I would do that first.

Then I would see what smartctl had to say about the disk and I would run any available tests smartctl gave me access to. (If you don't already have that data from a regular testing schedule.)

R00KIE · 2013-10-01 22:36:42

I don't even bother using dd anymore and go straight for ddrescue, usually I use 'ddrescue -S /dev/sd[a-z] /path/to/image.img /path/to/log.txt'. Using the log is important as you can stop the copy and resume it later if you need.

As for recovering the partition table, if you had a MBR setup I would give testdisk a try, it is able to try to find where partitons are and I've had luck with it before.

cfr · 2013-10-01 23:09:35

R00KIE wrote:

I don't even bother using dd anymore and go straight for ddrescue, usually I use 'ddrescue -S /dev/sd[a-z] /path/to/image.img /path/to/log.txt'. Using the log is important as you can stop the copy and resume it later if you need.

That seems important. Just to say, I wasn't recommending any particular options - just that I would use ddrescue rather than dd, if it were me, to do the initial imaging.

wolfdogg · 2013-10-02 00:07:47

Thanks for all the awesome replies. I think i have most of whats mentioned covered and it appears im not yet able to expose anything but a blank drive yet, but there has been a couple problems im hoping for some direction with.

Pse wrote:

fdisk -l /mnt/mounted-drive-with-enough-space/home/user/250.img

Well, i went ahead and scrapped the images i ran using disk copy (sector by sector copy), and the ddrescue i ran from the image from disk copy. now i was back at ground zero with a bit more experience, since i understand whatd needed a little better now.

So last night before caching in , i started this whole process over, so from a clean slate;

I am currently using system-rescue-cd on the system that contains the bad drive, coolest thing is im able to do this via ssh because the system-rescue-cd has it already implemented, so now i can paste the actual info.

First i ran gdisk on /dev/sdb (an extra empty drive), then zapped the partition tables, then i ran fdisk and recreated the MBR so it would match the drive im imaging. then i created 3 partitions on this new drive (sdb) for imaging use(275G,275G,200G). i formatted the first with ext3, and left the other two alone for now. Is this the proper filesystem that i should be doing this kind of work on?
I then ran re-ran ddrescue from scratch(i.e. no current existing ddrescue log) this time straight from the data compromised drive (sda (MBR)) imaging it to the freshly prepared drive (sdb (MBR)).

root@sysresccd /mnt/sdb1 % ddrescue -r 3 -v /dev/sda /mnt/sdb1/sda.img /mnt/sdb1/sda_dd.log

About to copy 250058 MBytes from /dev/sda to /mnt/sdb1/sda.img
    Starting positions: infile = 0 B,  outfile = 0 B
    Copy block size: 128 sectors
Sector size: 512  bytes
Max retries: 3
Direct: no    Sparse: no    Split: yes    Truncate: no

Press Ctrl-C to interrupt
Initial status (read from logfile)
rescued:   365494 kB,  errsize:       0 B,  errors:       0
Current status
rescued:   250058 MB,  errsize:       0 B,  current rate:   34930 kB/s
   ipos:   250058 MB,   errors:       0,    average rate:   33631 kB/s
   opos:   250058 MB,     time from last successful read:       0 s
Finished

root@sysresccd /mnt/sdb1 % ll
total 234G
drwxr-xr-x  3 root root 4.0K Oct  1 01:24 .
drwxr-xr-x 13 root root  220 Oct  1 01:44 ..
drwx------  2 root root  16K Oct  1 01:17 lost+found
-rw-r--r--  1 root root  244 Oct  1 03:29 sda_dd.log
-rw-r--r--  1 root root 233G Oct  1 03:28 sda.img

then i tried your command, and i thought this was awesome because i didnt know i could pull partition tables from an image with fdisk. unfortunately this is what im getting.

root@sysresccd /mnt % fdisk -l /mnt/sdb1/sda.img

Disk /mnt/sdb1/sda.img: 250.1 GB, 250058268160 bytes
255 heads, 63 sectors/track, 30401 cylinders, total 488395055 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x4ce64ce5

            Device Boot      Start         End      Blocks   Id  System
root@sysresccd /mnt %

what in 'tarnations' is going on with that? i think i need to solve this issue of no partition table first before i can go any further dont i ?

vacant wrote:

What does smartctl say about the drive (and your other drives)?
How is the motherboard, drive pins, cables, all nice and tight?
Could you have been hacked?

i dont think theres any problems with the drive other than its getting old

root@sysresccd /mnt % smartctl --all /dev/sda
smartctl 5.42 2011-10-20 r3458 [i686-linux-3.0.21-std250-i586] (local build)
Copyright (C) 2002-11 by Bruce Allen, http://smartmontools.sourceforge.net

=== START OF INFORMATION SECTION ===
Model Family:     Seagate Barracuda 7200.8
Device Model:     ST3250823AS
Serial Number:    5ND0MS6K
Firmware Version: 3.03
User Capacity:    250,058,268,160 bytes [250 GB]
Sector Size:      512 bytes logical/physical
Device is:        In smartctl database [for details use: -P show]
ATA Version is:   7
ATA Standard is:  Exact ATA specification draft version not indicated
Local Time is:    Tue Oct  1 16:05:26 2013 UTC
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED

General SMART Values:
Offline data collection status:  (0x82) Offline data collection activity
                                        was completed without error.
                                        Auto Offline Data Collection: Enabled.
Self-test execution status:      (   0) The previous self-test routine completed
                                        without error or no self-test has ever
                                        been run.
Total time to complete Offline
data collection:                (  430) seconds.
Offline data collection
capabilities:                    (0x5b) SMART execute Offline immediate.
                                        Auto Offline data collection on/off support.
                                        Suspend Offline collection upon new
                                        command.
                                        Offline surface scan supported.
                                        Self-test supported.
                                        No Conveyance Self-test supported.
                                        Selective Self-test supported.
SMART capabilities:            (0x0003) Saves SMART data before entering
                                        power-saving mode.
                                        Supports SMART auto save timer.
Error logging capability:        (0x01) Error logging supported.
                                        General Purpose Logging supported.
Short self-test routine
recommended polling time:        (   1) minutes.
Extended self-test routine
recommended polling time:        (  84) minutes.

SMART Attributes Data Structure revision number: 10
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED  WHEN_FAILED RAW_VALUE
  1 Raw_Read_Error_Rate     0x000f   056   049   006    Pre-fail  Always       -       88252521
  3 Spin_Up_Time            0x0003   098   098   000    Pre-fail  Always       -       0
  4 Start_Stop_Count        0x0032   100   100   020    Old_age   Always       -       900
  5 Reallocated_Sector_Ct   0x0033   100   100   036    Pre-fail  Always       -       0
  7 Seek_Error_Rate         0x000f   088   060   030    Pre-fail  Always       -       781682545
  9 Power_On_Hours          0x0032   055   055   000    Old_age   Always       -       39872
 10 Spin_Retry_Count        0x0013   100   100   097    Pre-fail  Always       -       0
 12 Power_Cycle_Count       0x0032   100   100   020    Old_age   Always       -       232
194 Temperature_Celsius     0x0022   047   054   000    Old_age   Always       -       47 (0 12 0 0 0)
195 Hardware_ECC_Recovered  0x001a   056   049   000    Old_age   Always       -       88252521
197 Current_Pending_Sector  0x0012   100   100   000    Old_age   Always       -       0
198 Offline_Uncorrectable   0x0010   100   100   000    Old_age   Offline      -       0
199 UDMA_CRC_Error_Count    0x003e   200   200   000    Old_age   Always       -       0
200 Multi_Zone_Error_Rate   0x0000   100   253   000    Old_age   Offline      -       0
202 Data_Address_Mark_Errs  0x0032   100   253   000    Old_age   Always       -       0

SMART Error Log Version: 1
ATA Error Count: 248 (device log contains only the most recent five errors)
        CR = Command Register [HEX]
        FR = Features Register [HEX]
        SC = Sector Count Register [HEX]
        SN = Sector Number Register [HEX]
        CL = Cylinder Low Register [HEX]
        CH = Cylinder High Register [HEX]
        DH = Device/Head Register [HEX]
        DC = Device Command Register [HEX]
        ER = Error register [HEX]
        ST = Status register [HEX]
Powered_Up_Time is measured from power on, and printed as
DDd+hh:mm:SS.sss where DD=days, hh=hours, mm=minutes,
SS=sec, and sss=millisec. It "wraps" after 49.710 days.

Error 248 occurred at disk power-on lifetime: 39857 hours (1660 days + 17 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  10 51 01 2e 51 1c ed

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  37 ff 01 2e 51 1c ed 00   1d+01:03:27.927  SET MAX ADDRESS EXT
  27 ff 00 2e 51 1c e0 00   1d+01:03:27.927  READ NATIVE MAX ADDRESS EXT
  37 ff 00 2e 51 1c ed 00   1d+01:03:27.746  SET MAX ADDRESS EXT
  27 ff 01 2e 51 1c e0 00   1d+01:03:27.744  READ NATIVE MAX ADDRESS EXT
  37 ff 01 2e 51 1c ed 00   1d+01:03:27.744  SET MAX ADDRESS EXT

Error 247 occurred at disk power-on lifetime: 39857 hours (1660 days + 17 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  10 51 01 2e 51 1c ed

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  37 ff 01 2e 51 1c ed 00   1d+01:03:27.927  SET MAX ADDRESS EXT
  27 ff 00 2e 51 1c e0 00   1d+01:03:27.927  READ NATIVE MAX ADDRESS EXT
  37 ff 00 2e 51 1c ed 00   1d+01:03:27.746  SET MAX ADDRESS EXT
  27 ff 01 6f 59 1c e0 00   1d+01:03:27.744  READ NATIVE MAX ADDRESS EXT
  29 00 01 6f 59 1c e0 00   1d+01:03:27.744  READ MULTIPLE EXT

Error 246 occurred at disk power-on lifetime: 39856 hours (1660 days + 16 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  10 51 01 2e 51 1c ed

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  37 ff 01 2e 51 1c ed 00   1d+00:36:04.705  SET MAX ADDRESS EXT
  27 ff 00 2e 51 1c e0 00   1d+00:36:04.704  READ NATIVE MAX ADDRESS EXT
  37 ff 00 2e 51 1c ed 00   1d+00:36:04.704  SET MAX ADDRESS EXT
  27 ff 01 2e 51 1c e0 00   1d+00:36:18.599  READ NATIVE MAX ADDRESS EXT
  37 ff 01 2e 51 1c ed 00   1d+00:36:18.599  SET MAX ADDRESS EXT

Error 245 occurred at disk power-on lifetime: 39856 hours (1660 days + 16 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  10 51 01 2e 51 1c ed

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  37 ff 01 2e 51 1c ed 00   1d+00:36:04.705  SET MAX ADDRESS EXT
  27 ff 00 2e 51 1c e0 00   1d+00:36:04.704  READ NATIVE MAX ADDRESS EXT
  37 ff 00 2e 51 1c ed 00   1d+00:36:04.704  SET MAX ADDRESS EXT
  27 ff 01 6f 59 1c e0 00   1d+00:36:04.704  READ NATIVE MAX ADDRESS EXT
  29 00 01 6f 59 1c e0 00   1d+00:36:03.811  READ MULTIPLE EXT

Error 244 occurred at disk power-on lifetime: 39852 hours (1660 days + 12 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  10 51 01 2e 51 1c ed

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  37 ff 01 2e 51 1c ed 00      19:54:21.873  SET MAX ADDRESS EXT
  27 ff 00 2e 51 1c e0 00      19:54:21.873  READ NATIVE MAX ADDRESS EXT
  37 ff 00 2e 51 1c ed 00      19:54:21.872  SET MAX ADDRESS EXT
  27 ff 01 2e 51 1c e0 00      19:54:35.947  READ NATIVE MAX ADDRESS EXT
  37 ff 01 2e 51 1c ed 00      19:54:35.947  SET MAX ADDRESS EXT

SMART Self-test log structure revision number 1
Num  Test_Description    Status                  Remaining  LifeTime(hours)  LBA_of_first_error
# 1  Short offline       Completed without error       00%     39833         -
# 2  Short offline       Completed without error       00%     39659         -
# 3  Extended offline    Completed without error       00%     39654         -
# 4  Short offline       Completed without error       00%     39635         -
# 5  Extended offline    Completed without error       00%     39618         -
# 6  Extended offline    Completed without error       00%     39614         -
# 7  Short offline       Completed without error       00%     39593         -
# 8  Short offline       Completed without error       00%     38157         -

SMART Selective self-test log data structure revision number 1
 SPAN  MIN_LBA  MAX_LBA  CURRENT_TEST_STATUS
    1        0        0  Not_testing
    2        0        0  Not_testing
    3        0        0  Not_testing
    4        0        0  Not_testing
    5        0        0  Not_testing
Selective self-test flags (0x0):
  After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minute delay.

root@sysresccd /mnt %

i rechecked the cables a few times night before last after it happened, and i couldnt have gotten hacked becuase it was booting fine, until the moment i put in a rescue disk, and tried to boot it, realized cmos wasnt set properly to boot from cd, and powered off seconds too late after the drive was mounted. and viola, the partition tables were erased at that moment, nearest i can figure.

cfr wrote:

Then I would see what smartctl had to say about the disk and I would run any available tests smartctl gave me access to. (If you don't already have that data from a regular testing schedule.)

yeah, i had started running regularly last week while i was doing drive maintenance. and i know why you prefer ddrescue with its careful order of extracting data. so its ok the way i did it, instead of running dd right?

ROOKIE wrote:

I don't even bother using dd anymore and go straight for ddrescue, usually I use 'ddrescue -S /dev/sd[a-z] /path/to/image.img /path/to/log.txt'. Using the log is important as you can stop the copy and resume it later if you need.
As for recovering the partition table, if you had a MBR setup I would give testdisk a try, it is able to try to find where partitons are and I've had luck with it before.

whats doesn -S sparse writes do? i havent used that, would it help given i cant see any partition table? I though tried testdisk but looking back i think that was the other drive thats reporting bad sectors, so ill give that a try (again, see the OP, this time from system-rescue-cd).

EDIT: added last parentheses content

Last edited by wolfdogg (2013-10-02 01:09:52)

cfr · 2013-10-02 00:53:04

Well I would not completely trust a drive with those errors in the log even if it is passing the tests. That said, I used a disk with such errors for quite a while before it finally failed but now I've seen what a disk looks like before things start going wrong, I know that's not normal! That said, I don't know what the error you are seeing actually means...

So if I understand this stuff correctly, probably you need now to think about finding the starting position of each partition based on the type of filesystem you had on it - unless there is some other way of trying to recover the partition table?

EDIT: I think sparse just saves space by not copying zeros. Have you taken a look at info ddrescue (as opposed to just the manual page)? There's a lot of information there - looks useful.

Last edited by cfr (2013-10-02 00:58:37)

wolfdogg · 2013-10-02 01:03:20

yeah, im up to my ears in data, i recently got a new 2tb drive, its the only reason i have extra space on the 4 other drives, because i was breaking down my zfs array to repair those ailing drives, in doing so, now i lost the operating system drive which incindentally had temporary IMPORTANT backup data on it from the other 4. ill be systematically replacing all my drives with 2tb drives and up, nothing smaller, then i will slowly pull myself out of this issue and eventually have everything backed up properly to a zfs raidz, instead of just a zfs linear which has no redundancy.

i cant figure out how to mount the entire image so i can look into it. i get this when i try to mount it,

root@sysresccd /root % mount /mnt/sdb1/sda.img /mnt/tmp
mount: you must specify the filesystem type
root@sysresccd /root %

and when i run this form the wiki

# losetup -f -P /path/to/image

i get an error because the systemrescue cds installation of losetup doesnt support this.

root@sysresccd /root % losetup --help
losetup: invalid option -- '-'
usage:
  losetup [options] loop_device file        # setup
  losetup -F [options] loop_device [file]   # setup, read /etc/fstab
  losetup loop_device                       # give info
  losetup -a                                # give info of all loops
  losetup -f                                # show next free loop device
  losetup -d loop_device                    # delete
  losetup -R loop_device                    # resize
options:  -e encryption  -o offset  -s sizelimit  -p passwdfd  -T  -S pseed
          -H phash  -I loinit  -K gpgkey  -G gpghome  -C itercountk  -v  -r
          -P cleartextkey

hey i should probably use the arch boot disc on that one eh? So, my question is, how do i mount this image? do i need to use losetup since its a multi partion image, or is there a way to mount it somehow raw just to see if theres any data in there at all, or if its just a bunch of empty sectors?

edit: you mean this? http://www.manpagez.com/info/ddrescue/ddrescue-1.9/ if so, not yet, thanks for the link, ill be studying it shortly. :-)

Last edited by wolfdogg (2013-10-02 01:11:41)

cfr · 2013-10-02 01:10:09

I am out of my depth but https://bbs.archlinux.org/viewtopic.php … 6#p1331906 had advice I would be considering if I were in your position i.e. get information about how to identify the start of partitions, use that information to identify them and then use the results to try to mount them.

wolfdogg · 2013-10-02 06:02:20

test disk shows nothing still

 TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63
     Partition               Start        End    Size in sectors

No partition found or selected for recovery

i do see this in the beginning when i try to run it

Disk /dev/sda - 250 GB / 232 GiB - ST3250823AS

Hidden sectors are present.

size       488395055 sectors
user_max   488395055 sectors
native_max 488397168 sectors
dco        488397168 sectors
Host Protected Area (HPA) present.

>[ Continue ] Continue even if there are hidden data

the first sign of possible data, but i suspect this just means that bad sectors have been flagged to be not used??? i cant seem to find anywhere on the internet what this actually means.

after that message once i continue i get a choice of partition table types, im not really sure how to choose this one, but documentation 'seems' to be saying to trust testdisk on this one and choose default, but it doesnt necesarrily say try them all if it fails to fine one.
i see

intel, EPT GPT, apple, none (non partitioned media), sun and xbox.

, so is intel simply MBR??

also i just figured out how to use testdisk on an img, it was extremely simple, at first i thought i needed to mount the image to a loop device, then test it, but NOPE, all you need to run is

testdisk sda.img

im at a total loss why no partitions are showing up, but im running scan on the image now, and then ill runa deeper scan later. its just crazy thats theres nothing.

im going to hitup irc shortly

Last edited by wolfdogg (2013-10-02 06:07:31)

R00KIE · 2013-10-02 13:09:02

The sparse option saves disk space and depending on the destination drive may make things go a little faster. If the source has lots of blank (all zeros) space then the zeros will not be written to the image.

Intel or MBR should be the same, however you should know what type of partition scheme you are using beforehand, otherwise I suppose testdisk might not return any useful data.

Testdisk can perform a deeper search and try to look for partitions on the whole disk (it will take time). It also seems testdisk supports gpt just fine, but I have no experience with it, I just remember having luck with a mbr setup where gparted screwed up and testdisk was able to figure out the correct partition table.

Another thing that caught my eye is why would you have a host protected area on that disk (it has nothing to do with bad sectors), it eats just a little over 1MB (at the end of the disk so it shouldn't matter) but it is still strange.

wolfdogg · 2013-10-03 08:13:01

i didnt have much luck, now im running spinrite and seeing whats going on wiht the sectors. either the hard drive failed, or i somehow erased it. im looking to recover the other drives now since i might be able to recover my data on those, which alrady had their partition tables replaced. im just going to repartition all of them to create a new large partition table on each of them, and give test disk, foremost, and spinrite a go to recover antything possible.

i did get an either devious, or ingenious suggestion from a couple guys in #archlinux irc, thanks to the suggestion. They said just create a large partition over the entire drive, name it linux, then recover my data that way. although it sounded great, and it did create that partition, i am still geting no where, and im not sure when he meant by recover the data. Im guessing he meant to run something like foremost, which yielded NOTHING.

im going to repeate this procedure on the rest of the drives to see if i can pull some data from the backups. thanks for all the help, it is much appreciated, and this became a great thread for data recovery!! i will definitely refer to it if i need to recover anyones data.

in the end, that sparse option might have been the one that saved my data, incidentally, since if i had used it, assuming all the sectors are zero as they appear, then the image wouldnt have writter over 250GB across two different drives effectively erasing any data that was there before.

man i wish i could mark "this" one solved!!

Last edited by wolfdogg (2013-10-03 08:15:52)

R00KIE · 2013-10-03 13:51:49

Testdisk does allow you to try to recover erased files, it reads the whole disk and tries to make sense of any data it finds, however with ext filesystems I haven't had much luck in recovering deleted files (I've read that is due to the way the filesystem works).

What I am not sure is if you need to have partitions on the disk or if it can scan the whole disk anyway, I keep testdisk installed just in case but I haven't used it in a while (thankfully).

The suggestion of creating a partiton over the whole disk might work if the data recovery program needs that. The part about naming it linux, I suppose that means marking the partition type as linux. You certainly don't want to format that newly created partition.

Fiddling only with the partition table is ok since the original ones are gone by now (by what you say). Just in case I would image all the disks to a backup, and then either work from the image or the disks themselfs. I prefer to leave the backups alone and work from the physical disks, it is easier since data recovery programs are expecting to work with a physical disk and if things go wrong you can always restore the backup.

A couple of last notes, from personal experience if one data recovery program can't find much or anything at all you won't have much luck with other programs, but I suppose one always tries all programs just in case (a bit of waste of time). After you sort out all the data recovery, look into all disks and disable host protected area for any disks that have it so you use the most of the hard disks.

Arch Linux

#1 2013-09-30 21:06:16

drive lost all 4 partitions during power off on early boot stage

#2 2013-09-30 21:53:35

Re: drive lost all 4 partitions during power off on early boot stage

#3 2013-09-30 22:03:41

Re: drive lost all 4 partitions during power off on early boot stage

#4 2013-09-30 22:15:17

Re: drive lost all 4 partitions during power off on early boot stage

#5 2013-09-30 22:17:27

Re: drive lost all 4 partitions during power off on early boot stage

#6 2013-09-30 23:03:12

Re: drive lost all 4 partitions during power off on early boot stage

#7 2013-09-30 23:59:02

Re: drive lost all 4 partitions during power off on early boot stage

#8 2013-10-01 00:24:33

Re: drive lost all 4 partitions during power off on early boot stage

#9 2013-10-01 01:46:29

Re: drive lost all 4 partitions during power off on early boot stage

#10 2013-10-01 02:37:25

Re: drive lost all 4 partitions during power off on early boot stage

#11 2013-10-01 06:14:57

Re: drive lost all 4 partitions during power off on early boot stage

#12 2013-10-01 08:02:10

Re: drive lost all 4 partitions during power off on early boot stage

#13 2013-10-01 15:26:05

Re: drive lost all 4 partitions during power off on early boot stage

#14 2013-10-01 15:37:03

Re: drive lost all 4 partitions during power off on early boot stage

#15 2013-10-01 21:09:15

Re: drive lost all 4 partitions during power off on early boot stage

#16 2013-10-01 22:36:42

Re: drive lost all 4 partitions during power off on early boot stage

#17 2013-10-01 23:09:35

Re: drive lost all 4 partitions during power off on early boot stage

#18 2013-10-02 00:07:47

Re: drive lost all 4 partitions during power off on early boot stage

#19 2013-10-02 00:53:04

Re: drive lost all 4 partitions during power off on early boot stage

#20 2013-10-02 01:03:20

Re: drive lost all 4 partitions during power off on early boot stage

#21 2013-10-02 01:10:09

Re: drive lost all 4 partitions during power off on early boot stage

#22 2013-10-02 06:02:20

Re: drive lost all 4 partitions during power off on early boot stage

#23 2013-10-02 13:09:02

Re: drive lost all 4 partitions during power off on early boot stage

#24 2013-10-03 08:13:01

Re: drive lost all 4 partitions during power off on early boot stage

#25 2013-10-03 13:51:49

Re: drive lost all 4 partitions during power off on early boot stage

Board footer