You are not logged in.
Well, it seems i have my share of drive problems lately. now my main system drive took a dive off the deepend, and i dont know why. It was booting fine, then after whatever caused it the partition table is gone.
main problem is, ALL my local web development work was on this drive, including old .git and svn repositories, and the snapshot backup of those, along with all /etc, and /home was temporarily on there while i work on my other drives. data loss is rearing its ugly head once again. its been about 10 years for me, and i swore that i would do everyting in my power to keep that from happening again.
the nearest i can figure is i made a huge mistake when powering off the system when trying to boot a boot cd, just after the intial stages of boot was occurring, and i thought i saw the ("mounting /" blah blah), when i let out a big expletive just as the power cycled off after the standard 4 second delay of the pc's power button. i realized that it was booting the wrong drive, so i needed to power cycle it, but i did it a few seconds too late.
the drive is a standard arch linux 4 partition system drive, including /, /boot, /home, swap. boot and home are ext3. i cant tell you at this moment if the partition table is GPT, or MBR. I can tell you after Test Disk finishes running.
1) On initial run, test disk didnt find ANYTHING, and when i selected "Load Backup" that didnt find anything either, even on a "Deeper Scan"
2) gparted gui shows nothing
3) running another tool on Hirens shows something like this, zeroed out!
0:0 0 0 0 0 0 0 0 0 0
1:0 0 0 0 0 0 0 0 0 0
2:0 0 0 0 0 0 0 0 0 0
3:0 0 0 0 0 0 0 0 0 0
i would have suspected this is 4 partitions, but when i check my other drives i see data in the 0: entry only, and the 1:, 2:, 3: entries are also there, but blank. so i guess those are not partitions.
how can a hard drive get its entire partition table erased in this fashion?
any specific tools that i should be using to test partition table, recover partition table, backup partition table?
EDIT: i added a 3rd entry to the list
Last edited by wolfdogg (2013-09-30 21:59:49)
Offline
First, if you have enough space somewhere else [1], do a complete image of the drive. Then attempt a partition table recovery with GParted. If that fails, you will need to use tools to scan the drive for the first block of each partition you want to rescue. There might be tools for that, though I cannot name any from the top of my head.
If you cannot do an image of the drive, then I would not try any fixes that write to the disk until I can get my data off of it.
Edit: [1] buying a new hard drive to use as a backup might be a good idea. You can but it now, and use it temporarily for the image.
Last edited by Pse (2013-09-30 21:54:53)
Offline
Definitely image it and work on the image - not the original.
Whether it is MBR or GPT may matter. GPT includes a backup copy of the partition table which may be used for recovery.
I guess you've read https://wiki.archlinux.org/index.php/Data_rescue?
CLI Paste | How To Ask Questions
Arch Linux | x86_64 | GPT | EFI boot | refind | stub loader | systemd | LVM2 on LUKS
Lenovo x270 | Intel(R) Core(TM) i5-7200U CPU @ 2.50GHz | Intel Wireless 8265/8275 | US keyboard w/ Euro | 512G NVMe INTEL SSDPEKKF512G7L
Offline
Wolfdog. Take a break. Go outside and get some fresh air, then come back inside and be methodical.
I'll bet you have multiple drives and that, for whatever reason, you are not talking to the one you think you are. Even if you are not, I think you need to walk away and come back when composed.
Nothing is too wonderful to be true, if it be consistent with the laws of nature -- Michael Faraday
Sometimes it is the people no one can imagine anything of who do the things no one can imagine. -- Alan Turing
---
How to Ask Questions the Smart Way
Offline
great suggestion, take a load off my chest that i didnt even know was there, :-) i have a drive i can back it up to, and will do so right now. any suggestion on the tool to clone with? There is so many tools in Hirens boot cd that im starting to love this disc, i see in the backup tools "Ghost 4 Linux" see this article http://en.alexnogard.com/g4l-ghost-4-li … artitions/ im going to try that one to start with and see how it goes.
My first thought was if i do this, can i try to recover the partitions on the drive i copied to? or maybe build them, until they work? is that an option?
Offline
I think ewaller probably had more than 130 seconds of break in mind... .
ddrescue is supposed to be very good, especially at retrying and trying in multiple ways.
CLI Paste | How To Ask Questions
Arch Linux | x86_64 | GPT | EFI boot | refind | stub loader | systemd | LVM2 on LUKS
Lenovo x270 | Intel(R) Core(TM) i5-7200U CPU @ 2.50GHz | Intel Wireless 8265/8275 | US keyboard w/ Euro | 512G NVMe INTEL SSDPEKKF512G7L
Offline
My first thought was if i do this, can i try to recover the partitions on the drive i copied to? or maybe build them, until they work? is that an option?
Yes, if you have an exact copy of the disk, you should be able to work on the backup.
Offline
I'll bet you have multiple drives and that, for whatever reason, you are not talking to the one you think you are.
Have you fully considered this possibility?
CLI Paste | How To Ask Questions
Arch Linux | x86_64 | GPT | EFI boot | refind | stub loader | systemd | LVM2 on LUKS
Lenovo x270 | Intel(R) Core(TM) i5-7200U CPU @ 2.50GHz | Intel Wireless 8265/8275 | US keyboard w/ Euro | 512G NVMe INTEL SSDPEKKF512G7L
Offline
lol, i didnt even see his message when i was composing that one, hehehe. its rainy outside, but i was doing some google mapping for a planned expedition coming up, so that got my mind off things, i was waiting for the image to complete. its now compltee. i think im going to run outside and mow the lawn since it hasnt rained since this morning, we got a bit of sun, and there will be rain for the next 3 months, so gotta do it while i can.
copy process executed succesfully, i used disk copy 2.3, took 3 hours, copied size 232.88GB, no read or write errors. ill com eback later in and read over this post, reply, and do some work. thanks!!!
Offline
i know im talking to the right drive, i only have one 250gb, i have definitely considered that. the others are 750gb, 750gb, 2tb, 500gb. all those show up with a partition table from test disk as well, it was only the 250 that didnt, plus i had all other drives disconnected at first when i was trying to boot to isolate out any other causes. for now, i have backed it up to the 2tb. im going to work on it there. im so happy to have it backed up, i cant thank you enough for that suggestion, since im my pea sized brain i was thinking my only option was to recover it, since i didnt see any data there.
im now ready to recover the partition using the 2tb drive that i copied it to, i will start with gdisk and take a look into it(just to check to see what it reads, nothing more, then i will try using ddrescue to see what it can find. Brings me to a question, when you do a sector by sector copy, does that mean the mbr/gpt was copied over too? because i had a gpt on the 2tb before copying onto it, and im still not sure what type the 250gb has.
Last edited by wolfdogg (2013-10-01 02:40:07)
Offline
ok so i ran disk copy first, as mentioned, and i kinda thought ddrescue was to rescue the files, but i see mainly its for imaging, i didnt figure that out until i was already 1/3rd of the way through the process. i ran parted magic, which is a desktop, then from the ternimal i am running ddrescue. after running ddrescue -v it appears that this is the better of the two, Gnu's gddrescue. A luck shot there, having not known about this before i started.
I now know the original drive was using a MBR (/dev/sda 250gb)
the commands i ran are as follows
//EaseUs Disk Copy 2.3 i used to copy the drive sector by sector, why i used this i dont know, i just like the idea of a sector
// by sector copy, i copied the initial drive (/dev/sda 250gb with MBR) to (/dev/sdd 750gb GPT)
//gdisk to partition a new backup drive (/dev/sdc GPT)
//make filesystem on this drive
# mkfs ext3 /dev/sdc1 (all 750gb)
# mount /dev/sdc1 /mnt/local/sdc
//run ddrescue on the copied disk (/dev/sdd) and image it to (/dev/sdc) not sure why i did this, but since i already copied the
// data to /dev/sdd i would rather not wear out /dev/sda at the moment.
# ddrescue -r 7 /dev/sdd /mnt/local/sdc/250.img /mnt/local/sdc/250.txt
so far its 150gb into the backup, and no errors yet.
did i do anything wrong so far? i know i should have used ddrescue in teh first place to copy /dev/sda to /dev/sdd and i would have been done with that step already, but thats hindsight. how about the -r 7, is that overkill, should i run different options instead?
also, am i supposed to be recovering files, or trying to recover teh partitions with this new image i just created with ddrescue after mounting it?
Last edited by wolfdogg (2013-10-01 06:19:09)
Offline
ok i had to stop the ddrescue after it got to 270 some odd gigabytes as i realized it was going to take the entire 2tb, atleast i thought it would, and try to put that onto the 750gb drive which is not going to fit. so i figured that was enough data. afterall i still have the log available if i need to start it from where i left off.
i followed this https://wiki.archlinux.org/index.php/Fi … isk_Images
# losetup -f -P /mnt/local/sdc/250.img
then i looked into /dev at the loop devices and noticed by the timestamp that the only loop device that was timestamped when i ran the command was loop2. its the only one, the rest of the 255 loop devices i see are all created when i loaded gparted i believe. when i looked into /mnt/local/250 its completely empty, no partition, no files. does this mean that only empty data was copied? thats a scary thought.
when i try to mount the loop device
# mkdir /mnt/temp
# mount /dev/loop2 /mnt/temp
i get the obvious error
mount: wrong fs type, bad option, bad superblock on /dev/loop2, missing codepage or helper program, or othe error.
no helpful message in dmesg either.
then i tried to follow some of the procedures on this page https://help.ubuntu.com/community/DataR … 6c0a2e94fb but i realize that without one drive image / no partitions, i cant really do anything at the moment.
im wondering if i should just now run ddrescue again, and create a new image, but this time run it on the original drive that lost its partitions (/dev/sda) is this my next step, to see if i can get some data out of it, or do i need to use some other tools now on the 250.img that was extracted from /mnt/local/sdc?
note, foremost, and e2sfsck are not available on parted magic i found. so if i need them ill have to download them and compile them on there. however 'make' is not on there either. should i install another distribution other than parted magic to be doing all these operations under? such as arch, on another drive?
Last edited by wolfdogg (2013-10-01 08:21:34)
Offline
I'd be using the GParted live-CD, a custom Arch install with only what I need, or a Ubuntu or Fedora live-CD.
I don't know much about the tools you used, but if the drive with the data you want to rescue does not have bad sectors, this is what I'd do to image it:
dd if=/dev/sdX of=/mnt/mounted-drive-with-enough-space/home/user/250.img bs=1M
Then you can work on the image. If you had an MBR in it, you can try to run fdisk. There's no need for a loop device yet:
fdisk -l /mnt/mounted-drive-with-enough-space/home/user/250.img
The hard part is either restoring the partition table, or finding the offsets for each partition. I'd probably ask for help in the mailing list/irc channel of the filesystem you were using for each partition. They'd probably know best how to find the first block of each partition.
When you know where the partition starts, you can then use a loop device and run whatever tools you like on it. To set up the loop device use:
losetup --find --show --offset <offset-of-partition> --sizelimit <size-of-partition> /mnt/mounted-drive-with-enough-space/home/user/250.img
Offline
3) running another tool on Hirens shows something like this, zeroed out!
0:0 0 0 0 0 0 0 0 0 0
1:0 0 0 0 0 0 0 0 0 0
2:0 0 0 0 0 0 0 0 0 0
3:0 0 0 0 0 0 0 0 0 0
i would have suspected this is 4 partitions, but when i check my other drives i see data in the 0: entry only, and the 1:, 2:, 3: entries are also there, but blank. so i guess those are not partitions.how can a hard drive get its entire partition table erased in this fashion?
What does smartctl say about the drive (and your other drives)?
How is the motherboard, drive pins, cables, all nice and tight?
Could you have been hacked?
Offline
I don't know much about the tools you used, but if the drive with the data you want to rescue does not have bad sectors, this is what I'd do to image it:
dd if=/dev/sdX of=/mnt/mounted-drive-with-enough-space/home/user/250.img bs=1M
I'd probably do this with ddrescue. Certainly if dd ran into problems but I'd probably start with ddrescue in case I ran out of time to run a second programme. (But ddrescue will take longer so time could go the other way.)
I would do that first.
Then I would see what smartctl had to say about the disk and I would run any available tests smartctl gave me access to. (If you don't already have that data from a regular testing schedule.)
CLI Paste | How To Ask Questions
Arch Linux | x86_64 | GPT | EFI boot | refind | stub loader | systemd | LVM2 on LUKS
Lenovo x270 | Intel(R) Core(TM) i5-7200U CPU @ 2.50GHz | Intel Wireless 8265/8275 | US keyboard w/ Euro | 512G NVMe INTEL SSDPEKKF512G7L
Offline
I don't even bother using dd anymore and go straight for ddrescue, usually I use 'ddrescue -S /dev/sd[a-z] /path/to/image.img /path/to/log.txt'. Using the log is important as you can stop the copy and resume it later if you need.
As for recovering the partition table, if you had a MBR setup I would give testdisk a try, it is able to try to find where partitons are and I've had luck with it before.
R00KIE
Tm90aGluZyB0byBzZWUgaGVyZSwgbW92ZSBhbG9uZy4K
Offline
I don't even bother using dd anymore and go straight for ddrescue, usually I use 'ddrescue -S /dev/sd[a-z] /path/to/image.img /path/to/log.txt'. Using the log is important as you can stop the copy and resume it later if you need.
That seems important. Just to say, I wasn't recommending any particular options - just that I would use ddrescue rather than dd, if it were me, to do the initial imaging.
CLI Paste | How To Ask Questions
Arch Linux | x86_64 | GPT | EFI boot | refind | stub loader | systemd | LVM2 on LUKS
Lenovo x270 | Intel(R) Core(TM) i5-7200U CPU @ 2.50GHz | Intel Wireless 8265/8275 | US keyboard w/ Euro | 512G NVMe INTEL SSDPEKKF512G7L
Offline
Thanks for all the awesome replies. I think i have most of whats mentioned covered and it appears im not yet able to expose anything but a blank drive yet, but there has been a couple problems im hoping for some direction with.
fdisk -l /mnt/mounted-drive-with-enough-space/home/user/250.img
Well, i went ahead and scrapped the images i ran using disk copy (sector by sector copy), and the ddrescue i ran from the image from disk copy. now i was back at ground zero with a bit more experience, since i understand whatd needed a little better now.
So last night before caching in , i started this whole process over, so from a clean slate;
I am currently using system-rescue-cd on the system that contains the bad drive, coolest thing is im able to do this via ssh because the system-rescue-cd has it already implemented, so now i can paste the actual info.
First i ran gdisk on /dev/sdb (an extra empty drive), then zapped the partition tables, then i ran fdisk and recreated the MBR so it would match the drive im imaging. then i created 3 partitions on this new drive (sdb) for imaging use(275G,275G,200G). i formatted the first with ext3, and left the other two alone for now. Is this the proper filesystem that i should be doing this kind of work on?
I then ran re-ran ddrescue from scratch(i.e. no current existing ddrescue log) this time straight from the data compromised drive (sda (MBR)) imaging it to the freshly prepared drive (sdb (MBR)).
root@sysresccd /mnt/sdb1 % ddrescue -r 3 -v /dev/sda /mnt/sdb1/sda.img /mnt/sdb1/sda_dd.log
About to copy 250058 MBytes from /dev/sda to /mnt/sdb1/sda.img
Starting positions: infile = 0 B, outfile = 0 B
Copy block size: 128 sectors
Sector size: 512 bytes
Max retries: 3
Direct: no Sparse: no Split: yes Truncate: no
Press Ctrl-C to interrupt
Initial status (read from logfile)
rescued: 365494 kB, errsize: 0 B, errors: 0
Current status
rescued: 250058 MB, errsize: 0 B, current rate: 34930 kB/s
ipos: 250058 MB, errors: 0, average rate: 33631 kB/s
opos: 250058 MB, time from last successful read: 0 s
Finished
root@sysresccd /mnt/sdb1 % ll
total 234G
drwxr-xr-x 3 root root 4.0K Oct 1 01:24 .
drwxr-xr-x 13 root root 220 Oct 1 01:44 ..
drwx------ 2 root root 16K Oct 1 01:17 lost+found
-rw-r--r-- 1 root root 244 Oct 1 03:29 sda_dd.log
-rw-r--r-- 1 root root 233G Oct 1 03:28 sda.img
then i tried your command, and i thought this was awesome because i didnt know i could pull partition tables from an image with fdisk. unfortunately this is what im getting.
root@sysresccd /mnt % fdisk -l /mnt/sdb1/sda.img
Disk /mnt/sdb1/sda.img: 250.1 GB, 250058268160 bytes
255 heads, 63 sectors/track, 30401 cylinders, total 488395055 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x4ce64ce5
Device Boot Start End Blocks Id System
root@sysresccd /mnt %
what in 'tarnations' is going on with that? i think i need to solve this issue of no partition table first before i can go any further dont i ?
What does smartctl say about the drive (and your other drives)?
How is the motherboard, drive pins, cables, all nice and tight?
Could you have been hacked?
i dont think theres any problems with the drive other than its getting old
root@sysresccd /mnt % smartctl --all /dev/sda
smartctl 5.42 2011-10-20 r3458 [i686-linux-3.0.21-std250-i586] (local build)
Copyright (C) 2002-11 by Bruce Allen, http://smartmontools.sourceforge.net
=== START OF INFORMATION SECTION ===
Model Family: Seagate Barracuda 7200.8
Device Model: ST3250823AS
Serial Number: 5ND0MS6K
Firmware Version: 3.03
User Capacity: 250,058,268,160 bytes [250 GB]
Sector Size: 512 bytes logical/physical
Device is: In smartctl database [for details use: -P show]
ATA Version is: 7
ATA Standard is: Exact ATA specification draft version not indicated
Local Time is: Tue Oct 1 16:05:26 2013 UTC
SMART support is: Available - device has SMART capability.
SMART support is: Enabled
=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED
General SMART Values:
Offline data collection status: (0x82) Offline data collection activity
was completed without error.
Auto Offline Data Collection: Enabled.
Self-test execution status: ( 0) The previous self-test routine completed
without error or no self-test has ever
been run.
Total time to complete Offline
data collection: ( 430) seconds.
Offline data collection
capabilities: (0x5b) SMART execute Offline immediate.
Auto Offline data collection on/off support.
Suspend Offline collection upon new
command.
Offline surface scan supported.
Self-test supported.
No Conveyance Self-test supported.
Selective Self-test supported.
SMART capabilities: (0x0003) Saves SMART data before entering
power-saving mode.
Supports SMART auto save timer.
Error logging capability: (0x01) Error logging supported.
General Purpose Logging supported.
Short self-test routine
recommended polling time: ( 1) minutes.
Extended self-test routine
recommended polling time: ( 84) minutes.
SMART Attributes Data Structure revision number: 10
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED WHEN_FAILED RAW_VALUE
1 Raw_Read_Error_Rate 0x000f 056 049 006 Pre-fail Always - 88252521
3 Spin_Up_Time 0x0003 098 098 000 Pre-fail Always - 0
4 Start_Stop_Count 0x0032 100 100 020 Old_age Always - 900
5 Reallocated_Sector_Ct 0x0033 100 100 036 Pre-fail Always - 0
7 Seek_Error_Rate 0x000f 088 060 030 Pre-fail Always - 781682545
9 Power_On_Hours 0x0032 055 055 000 Old_age Always - 39872
10 Spin_Retry_Count 0x0013 100 100 097 Pre-fail Always - 0
12 Power_Cycle_Count 0x0032 100 100 020 Old_age Always - 232
194 Temperature_Celsius 0x0022 047 054 000 Old_age Always - 47 (0 12 0 0 0)
195 Hardware_ECC_Recovered 0x001a 056 049 000 Old_age Always - 88252521
197 Current_Pending_Sector 0x0012 100 100 000 Old_age Always - 0
198 Offline_Uncorrectable 0x0010 100 100 000 Old_age Offline - 0
199 UDMA_CRC_Error_Count 0x003e 200 200 000 Old_age Always - 0
200 Multi_Zone_Error_Rate 0x0000 100 253 000 Old_age Offline - 0
202 Data_Address_Mark_Errs 0x0032 100 253 000 Old_age Always - 0
SMART Error Log Version: 1
ATA Error Count: 248 (device log contains only the most recent five errors)
CR = Command Register [HEX]
FR = Features Register [HEX]
SC = Sector Count Register [HEX]
SN = Sector Number Register [HEX]
CL = Cylinder Low Register [HEX]
CH = Cylinder High Register [HEX]
DH = Device/Head Register [HEX]
DC = Device Command Register [HEX]
ER = Error register [HEX]
ST = Status register [HEX]
Powered_Up_Time is measured from power on, and printed as
DDd+hh:mm:SS.sss where DD=days, hh=hours, mm=minutes,
SS=sec, and sss=millisec. It "wraps" after 49.710 days.
Error 248 occurred at disk power-on lifetime: 39857 hours (1660 days + 17 hours)
When the command that caused the error occurred, the device was active or idle.
After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
10 51 01 2e 51 1c ed
Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
37 ff 01 2e 51 1c ed 00 1d+01:03:27.927 SET MAX ADDRESS EXT
27 ff 00 2e 51 1c e0 00 1d+01:03:27.927 READ NATIVE MAX ADDRESS EXT
37 ff 00 2e 51 1c ed 00 1d+01:03:27.746 SET MAX ADDRESS EXT
27 ff 01 2e 51 1c e0 00 1d+01:03:27.744 READ NATIVE MAX ADDRESS EXT
37 ff 01 2e 51 1c ed 00 1d+01:03:27.744 SET MAX ADDRESS EXT
Error 247 occurred at disk power-on lifetime: 39857 hours (1660 days + 17 hours)
When the command that caused the error occurred, the device was active or idle.
After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
10 51 01 2e 51 1c ed
Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
37 ff 01 2e 51 1c ed 00 1d+01:03:27.927 SET MAX ADDRESS EXT
27 ff 00 2e 51 1c e0 00 1d+01:03:27.927 READ NATIVE MAX ADDRESS EXT
37 ff 00 2e 51 1c ed 00 1d+01:03:27.746 SET MAX ADDRESS EXT
27 ff 01 6f 59 1c e0 00 1d+01:03:27.744 READ NATIVE MAX ADDRESS EXT
29 00 01 6f 59 1c e0 00 1d+01:03:27.744 READ MULTIPLE EXT
Error 246 occurred at disk power-on lifetime: 39856 hours (1660 days + 16 hours)
When the command that caused the error occurred, the device was active or idle.
After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
10 51 01 2e 51 1c ed
Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
37 ff 01 2e 51 1c ed 00 1d+00:36:04.705 SET MAX ADDRESS EXT
27 ff 00 2e 51 1c e0 00 1d+00:36:04.704 READ NATIVE MAX ADDRESS EXT
37 ff 00 2e 51 1c ed 00 1d+00:36:04.704 SET MAX ADDRESS EXT
27 ff 01 2e 51 1c e0 00 1d+00:36:18.599 READ NATIVE MAX ADDRESS EXT
37 ff 01 2e 51 1c ed 00 1d+00:36:18.599 SET MAX ADDRESS EXT
Error 245 occurred at disk power-on lifetime: 39856 hours (1660 days + 16 hours)
When the command that caused the error occurred, the device was active or idle.
After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
10 51 01 2e 51 1c ed
Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
37 ff 01 2e 51 1c ed 00 1d+00:36:04.705 SET MAX ADDRESS EXT
27 ff 00 2e 51 1c e0 00 1d+00:36:04.704 READ NATIVE MAX ADDRESS EXT
37 ff 00 2e 51 1c ed 00 1d+00:36:04.704 SET MAX ADDRESS EXT
27 ff 01 6f 59 1c e0 00 1d+00:36:04.704 READ NATIVE MAX ADDRESS EXT
29 00 01 6f 59 1c e0 00 1d+00:36:03.811 READ MULTIPLE EXT
Error 244 occurred at disk power-on lifetime: 39852 hours (1660 days + 12 hours)
When the command that caused the error occurred, the device was active or idle.
After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
10 51 01 2e 51 1c ed
Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
37 ff 01 2e 51 1c ed 00 19:54:21.873 SET MAX ADDRESS EXT
27 ff 00 2e 51 1c e0 00 19:54:21.873 READ NATIVE MAX ADDRESS EXT
37 ff 00 2e 51 1c ed 00 19:54:21.872 SET MAX ADDRESS EXT
27 ff 01 2e 51 1c e0 00 19:54:35.947 READ NATIVE MAX ADDRESS EXT
37 ff 01 2e 51 1c ed 00 19:54:35.947 SET MAX ADDRESS EXT
SMART Self-test log structure revision number 1
Num Test_Description Status Remaining LifeTime(hours) LBA_of_first_error
# 1 Short offline Completed without error 00% 39833 -
# 2 Short offline Completed without error 00% 39659 -
# 3 Extended offline Completed without error 00% 39654 -
# 4 Short offline Completed without error 00% 39635 -
# 5 Extended offline Completed without error 00% 39618 -
# 6 Extended offline Completed without error 00% 39614 -
# 7 Short offline Completed without error 00% 39593 -
# 8 Short offline Completed without error 00% 38157 -
SMART Selective self-test log data structure revision number 1
SPAN MIN_LBA MAX_LBA CURRENT_TEST_STATUS
1 0 0 Not_testing
2 0 0 Not_testing
3 0 0 Not_testing
4 0 0 Not_testing
5 0 0 Not_testing
Selective self-test flags (0x0):
After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minute delay.
root@sysresccd /mnt %
i rechecked the cables a few times night before last after it happened, and i couldnt have gotten hacked becuase it was booting fine, until the moment i put in a rescue disk, and tried to boot it, realized cmos wasnt set properly to boot from cd, and powered off seconds too late after the drive was mounted. and viola, the partition tables were erased at that moment, nearest i can figure.
Then I would see what smartctl had to say about the disk and I would run any available tests smartctl gave me access to. (If you don't already have that data from a regular testing schedule.)
yeah, i had started running regularly last week while i was doing drive maintenance. and i know why you prefer ddrescue with its careful order of extracting data. so its ok the way i did it, instead of running dd right?
I don't even bother using dd anymore and go straight for ddrescue, usually I use 'ddrescue -S /dev/sd[a-z] /path/to/image.img /path/to/log.txt'. Using the log is important as you can stop the copy and resume it later if you need.
As for recovering the partition table, if you had a MBR setup I would give testdisk a try, it is able to try to find where partitons are and I've had luck with it before.
whats doesn -S sparse writes do? i havent used that, would it help given i cant see any partition table? I though tried testdisk but looking back i think that was the other drive thats reporting bad sectors, so ill give that a try (again, see the OP, this time from system-rescue-cd).
EDIT: added last parentheses content
Last edited by wolfdogg (2013-10-02 01:09:52)
Offline
Well I would not completely trust a drive with those errors in the log even if it is passing the tests. That said, I used a disk with such errors for quite a while before it finally failed but now I've seen what a disk looks like before things start going wrong, I know that's not normal! That said, I don't know what the error you are seeing actually means...
So if I understand this stuff correctly, probably you need now to think about finding the starting position of each partition based on the type of filesystem you had on it - unless there is some other way of trying to recover the partition table?
EDIT: I think sparse just saves space by not copying zeros. Have you taken a look at info ddrescue (as opposed to just the manual page)? There's a lot of information there - looks useful.
Last edited by cfr (2013-10-02 00:58:37)
CLI Paste | How To Ask Questions
Arch Linux | x86_64 | GPT | EFI boot | refind | stub loader | systemd | LVM2 on LUKS
Lenovo x270 | Intel(R) Core(TM) i5-7200U CPU @ 2.50GHz | Intel Wireless 8265/8275 | US keyboard w/ Euro | 512G NVMe INTEL SSDPEKKF512G7L
Offline
yeah, im up to my ears in data, i recently got a new 2tb drive, its the only reason i have extra space on the 4 other drives, because i was breaking down my zfs array to repair those ailing drives, in doing so, now i lost the operating system drive which incindentally had temporary IMPORTANT backup data on it from the other 4. ill be systematically replacing all my drives with 2tb drives and up, nothing smaller, then i will slowly pull myself out of this issue and eventually have everything backed up properly to a zfs raidz, instead of just a zfs linear which has no redundancy.
i cant figure out how to mount the entire image so i can look into it. i get this when i try to mount it,
root@sysresccd /root % mount /mnt/sdb1/sda.img /mnt/tmp
mount: you must specify the filesystem type
root@sysresccd /root %
and when i run this form the wiki
# losetup -f -P /path/to/image
i get an error because the systemrescue cds installation of losetup doesnt support this.
root@sysresccd /root % losetup --help
losetup: invalid option -- '-'
usage:
losetup [options] loop_device file # setup
losetup -F [options] loop_device [file] # setup, read /etc/fstab
losetup loop_device # give info
losetup -a # give info of all loops
losetup -f # show next free loop device
losetup -d loop_device # delete
losetup -R loop_device # resize
options: -e encryption -o offset -s sizelimit -p passwdfd -T -S pseed
-H phash -I loinit -K gpgkey -G gpghome -C itercountk -v -r
-P cleartextkey
hey i should probably use the arch boot disc on that one eh? So, my question is, how do i mount this image? do i need to use losetup since its a multi partion image, or is there a way to mount it somehow raw just to see if theres any data in there at all, or if its just a bunch of empty sectors?
edit: you mean this? http://www.manpagez.com/info/ddrescue/ddrescue-1.9/ if so, not yet, thanks for the link, ill be studying it shortly. :-)
Last edited by wolfdogg (2013-10-02 01:11:41)
Offline
I am out of my depth but https://bbs.archlinux.org/viewtopic.php … 6#p1331906 had advice I would be considering if I were in your position i.e. get information about how to identify the start of partitions, use that information to identify them and then use the results to try to mount them.
CLI Paste | How To Ask Questions
Arch Linux | x86_64 | GPT | EFI boot | refind | stub loader | systemd | LVM2 on LUKS
Lenovo x270 | Intel(R) Core(TM) i5-7200U CPU @ 2.50GHz | Intel Wireless 8265/8275 | US keyboard w/ Euro | 512G NVMe INTEL SSDPEKKF512G7L
Offline
test disk shows nothing still
TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63
Partition Start End Size in sectors
No partition found or selected for recovery
i do see this in the beginning when i try to run it
Disk /dev/sda - 250 GB / 232 GiB - ST3250823AS
Hidden sectors are present.
size 488395055 sectors
user_max 488395055 sectors
native_max 488397168 sectors
dco 488397168 sectors
Host Protected Area (HPA) present.
>[ Continue ] Continue even if there are hidden data
the first sign of possible data, but i suspect this just means that bad sectors have been flagged to be not used??? i cant seem to find anywhere on the internet what this actually means.
after that message once i continue i get a choice of partition table types, im not really sure how to choose this one, but documentation 'seems' to be saying to trust testdisk on this one and choose default, but it doesnt necesarrily say try them all if it fails to fine one.
i see
intel, EPT GPT, apple, none (non partitioned media), sun and xbox.
, so is intel simply MBR??
also i just figured out how to use testdisk on an img, it was extremely simple, at first i thought i needed to mount the image to a loop device, then test it, but NOPE, all you need to run is
testdisk sda.img
im at a total loss why no partitions are showing up, but im running scan on the image now, and then ill runa deeper scan later. its just crazy thats theres nothing.
im going to hitup irc shortly
Last edited by wolfdogg (2013-10-02 06:07:31)
Offline
The sparse option saves disk space and depending on the destination drive may make things go a little faster. If the source has lots of blank (all zeros) space then the zeros will not be written to the image.
Intel or MBR should be the same, however you should know what type of partition scheme you are using beforehand, otherwise I suppose testdisk might not return any useful data.
Testdisk can perform a deeper search and try to look for partitions on the whole disk (it will take time). It also seems testdisk supports gpt just fine, but I have no experience with it, I just remember having luck with a mbr setup where gparted screwed up and testdisk was able to figure out the correct partition table.
Another thing that caught my eye is why would you have a host protected area on that disk (it has nothing to do with bad sectors), it eats just a little over 1MB (at the end of the disk so it shouldn't matter) but it is still strange.
R00KIE
Tm90aGluZyB0byBzZWUgaGVyZSwgbW92ZSBhbG9uZy4K
Offline
i didnt have much luck, now im running spinrite and seeing whats going on wiht the sectors. either the hard drive failed, or i somehow erased it. im looking to recover the other drives now since i might be able to recover my data on those, which alrady had their partition tables replaced. im just going to repartition all of them to create a new large partition table on each of them, and give test disk, foremost, and spinrite a go to recover antything possible.
i did get an either devious, or ingenious suggestion from a couple guys in #archlinux irc, thanks to the suggestion. They said just create a large partition over the entire drive, name it linux, then recover my data that way. although it sounded great, and it did create that partition, i am still geting no where, and im not sure when he meant by recover the data. Im guessing he meant to run something like foremost, which yielded NOTHING.
im going to repeate this procedure on the rest of the drives to see if i can pull some data from the backups. thanks for all the help, it is much appreciated, and this became a great thread for data recovery!! i will definitely refer to it if i need to recover anyones data.
in the end, that sparse option might have been the one that saved my data, incidentally, since if i had used it, assuming all the sectors are zero as they appear, then the image wouldnt have writter over 250GB across two different drives effectively erasing any data that was there before.
man i wish i could mark "this" one solved!!
Last edited by wolfdogg (2013-10-03 08:15:52)
Offline
Testdisk does allow you to try to recover erased files, it reads the whole disk and tries to make sense of any data it finds, however with ext filesystems I haven't had much luck in recovering deleted files (I've read that is due to the way the filesystem works).
What I am not sure is if you need to have partitions on the disk or if it can scan the whole disk anyway, I keep testdisk installed just in case but I haven't used it in a while (thankfully).
The suggestion of creating a partiton over the whole disk might work if the data recovery program needs that. The part about naming it linux, I suppose that means marking the partition type as linux. You certainly don't want to format that newly created partition.
Fiddling only with the partition table is ok since the original ones are gone by now (by what you say). Just in case I would image all the disks to a backup, and then either work from the image or the disks themselfs. I prefer to leave the backups alone and work from the physical disks, it is easier since data recovery programs are expecting to work with a physical disk and if things go wrong you can always restore the backup.
A couple of last notes, from personal experience if one data recovery program can't find much or anything at all you won't have much luck with other programs, but I suppose one always tries all programs just in case (a bit of waste of time). After you sort out all the data recovery, look into all disks and disable host protected area for any disks that have it so you use the most of the hard disks.
R00KIE
Tm90aGluZyB0byBzZWUgaGVyZSwgbW92ZSBhbG9uZy4K
Offline