fdisk partition / disklabel recovery (help!)

[Alexander Leidinger]

Quoting Eric Anderson <anderson at centtech.com> (from Tue, 13 Jun 2006  
16:02:33 -0500 (CDT)):

> Alexander Leidinger said:
>> Quoting "Eric Anderson" <anderson at centtech.com> (Tue, 13 Jun 2006 12:33:14
>> -0500 (CDT)):
>>
>>> >From the subject, you probably already know my dilemma.  After booting
>>> a
>>> linux livecd (I'll refrain from naming the distro), my laptop no longer
>>> has any partitions.  Now, the drive was not newfs'ed with any other OS,
>>> so
>>> I believe only the boot loader and partitioning are messed up.  I see an
>>> ffsrecov tool, that could probably help me, but I want to make sure I
>>> don't make any bad decisions here.
>>>
>>> So, my partitioning was something like:
>>> ad0
>>> ad0s1 DOS
>>> ad0s2 ??
>>> ad0s3 ??
>>> ad0s4 Linux root / swap
>>
>> For this particular reason I always print out the layout. Got hit once,
>> wrote a program to recover (only understands ufs1 disklabels, and
>> stopped to work after a particular 4.x... I assume it's because of a
>> blocksize/fragsize change introduced then), learned my lesson.
>
> I'll probably look into writing such a tool, since this is very painful. :(

You can have a look at  
http://www.leidinger.net/FreeBSD/ffsrescue.tar.gz to get an idea (I  
think some offsets are wrong now for UFS1, and UFS2-labels aren't  
searched) what to do.

> Printing is a good idea.  :)
>
>
>>> FreeBSD was on either ad0s2 or ad0s3, I can't recall which, but I
>>> believe
>>> it was ad0s3.  I had 3 partitions (/, /alt, /home) and a swap.
>>>
>>> I'm running the ffsrecov tool now, but it appears to be very slow
>>> chugging
>>> through the disk.
>>
>> There are ways to speed such a search up. I assume my own tool tries to
>> be too smart (or it's not smart enough, at least it uses wrong
>> invariants) for the disklabels. And it only prints assumptions about
>> the start of a FreeBSD slice, not about other slice types.
>
> Is there a good way to identify the bsdlabel, or other partitioning
> information from a hexdumped output?

You have to look at the superblock magic number at specific offsets.  
Have a look at the above mentioned code to see what to do for UFS1. It  
should give you a hint what you want to search for regarding UFS2.

Regarding the superblocks: if you remember the blocksize/fragsize you  
used, you can newfs a md on another system and have a look at which  
offsets superblocks are generated. For UFS1 the first one is in block  
16, the second one in block 32. So if you find two superblocks with a  
distance of 16 blocks, the start of a partition is probably 16 blocks  
before the first superblock. If you know which partition belongs to  
which slice (AFAIR "last mounted on" is available in the superblock),  
you should be able to find the right offsets for the slices. I don't  
know the numbers for UFS2 out of my head.

>>> Is there any additional ways I can find the partitioning scheme, or find
>>> the bsdlabel's on the disk?   Does anyone know of a command line
>>> (dd+some
>>
>> Try to remember them. If you know how large the partitions have been,
>> you just have to write the MBR and everything should work. If nothing
>> works, you remembered wrong.
>
> I have some general guesses as to the sizes.  Do you know if any of that
> data would be in a dmesg,sysctl,etc type output?  I have much of that
> logged to an external site I can look at for the details..

Maybe in some geom related output, but I'm not sure.

>>> tools/perl/etc) way to find the bsdlabels?
>>>
>>> Once the bsdlabels are found, then what?
>>>
>>> Also - if I rewrite the bsdlabel exactly as it was before, I should be
>>> in
>>> business, correct?
>>
>> The bsdlabels are still there I assume, it sounds just like your MBR
>> got hosed.
>
> fdisk reports nothing, so I'm sure I just need to put the fdisk
> partitioning back.  Problem is, I don't know the offsets.

I didn't knowed them either. But I remembered the size of the first  
partition, so I was able to recover at least the first 2 partitions  
out of my head at that time.

Bye,
Alexander.

-- 
Selling GoodYear Eagle F1 235/40ZR18, 2x 4mm + 2x 5mm, ~150 EUR
you have to pick it up between Germany/Saarland and Luxembourg/Capellen
http://www.Leidinger.net    Alexander @ Leidinger.net: PGP ID = B0063FE7
http://www.FreeBSD.org       netchild @ FreeBSD.org  : PGP ID = 72077137