How to recover data? - Formatted, Fdisk'd, and disklabeled ad1, now ad0 with FreeBSD is messed up

[Ruben Bloemgarten]

Hi Mark,
On disk ad1 you have one slice ad1s1 which has one partition ad1s1d, 
mount this 
# mount /dev/ad1s1d /mnt 
Now check the size of the partition :

#df -h 

If the size of this partition is equal to the size of your drive you just
used the entire drive for that one partition. If it's not you did not finish
labeling the remainder of the slice

I'm assuming that FBSD is installed on your other disk ad0 where you have
one slice ad0s1 and 5 partitions a,b,d,e,f, which I assume are /, swap, var,
usr and home respectively.

You cannot mount a slice directly.

A "c" partition is generated automatically and contains the entire slice.
This is not to be accessed directly.

".snap" is a directory created for the dump/restore utility the mksnap_fs in
particular. It is used for live snapshots of the file system. It should be
there and if that's all there is . . . that's all there is.

Now, for a total picture, I hope, it seems that you installed FBSD on ad0s1*
and newfs'd/disklabel ad1s1* hoping to later mount this and get y'r data on
there. If FBSD is not booting I assume you did not install any type of boot
manager.

The big mystery to me here is this : you say you 
 
1. you backed up the content of you 60 GB NTFS drive to your 160GB drive
(which I therefore assume to be ad0)
2. installed FBSD on you 160GB drive (still ad0)
3. newfs'd your 60GB drive ( ad1)

Euuuh, where is your data ????

Anyway, I hope this might have cleared things up, if not try :

http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/install.html

Good luck,

Ruben 



-----Original Message-----
From: owner-freebsd-questions at freebsd.org
[mailto:owner-freebsd-questions at freebsd.org] On Behalf Of Mark Kane
Sent: August 08, 2005 4:54 AM
To: Gary W. Swearingen
Cc: freebsd-questions at freebsd.org
Subject: Re: How to recover data? - Formatted, Fdisk'd, and disklabeled ad1,
now ad0 with FreeBSD is messed up

Gary W. Swearingen wrote:
> Mark Kane <mark at mkproductions.org> writes:
> 
> 
>>This morning, I came back to format the 60GB drive. I formatted it and ran
it through fdisk and disklabel. Whenever I do
> 
> 
> What does "I formatted it" mean?

That means that I used the PowerMax utility to zero fill the 60GB drive 
after I got all my data off of it and put it to the 160GB drive. I 
wanted to start completely clean, hoping that would maximize performance 
since it had been in NTFS and completely fragmented for several years 
(unable to defrag because it was so full, etc).

> I wonder if you really used fdisk and disklabel, or used sysinstall;

I used sysinstall to do this. I said that in the subject to just be 
clear on the operations I did. I did this exact same process yesterday 
with my 80GB drive that was having the DMA errors. I got a reply from 
the list on that issue saying to try another drive (since I have 4 
drives in NTFS that I'm trying to "convert" to UFS for use with 
FreeBSD). This 60GB was another of the 4 drives I was going to try to 
see if I would get any DMA errors...but unfortunately I didn't get that 
far ye.

> It sounds like you let sysinstall replace your ad0 MBR and maybe
> re-label an ad0 primary partition.  I'm sure you'll let me know if I'm
> wrong.

Well when I was in the fdisk and disklabel sections of sysinstall, I 
specifically saw "ad1" at the top, showing that I was modifying ad1 (the 
60GB drive). When I first went in to the disklabel editor, nothing was 
showing there since I had just fdisk'd it through the fdisk screen. If 
the existing labels were there (like /, /home, /var, etc), I wouldn't 
have proceeded. I did a "c" to create a new filesystem, told it how big, 
etc, and then "w" to write it. It went OK, and I exited out of the label 
editor and rebooted.

>>I found the FreeBSD 5.4 install CD and booted to the FixIt live
filesystem. I tried to look for my ad0 data, and I only
>>saw /dev/ad0 and /dev/ad0s1. I mounted /dev/ad0s1, and it's my root (/)
partition from before. I don't see any ad0s2,
>>ad0s3, ad0s4, etc.
>>
>>As for ad1, I see ad1s1, ad1s1c, and ad1s1d. ad1s1 gives "Operation Not
Permitted" when I try to mount it. ad1s1c and
>>ad1s1d just show ".snap/" directories when I mount and ls them.
> 
> 
> You say you mounted "ad0s1" and tried to mount "ad0s1".  AFAIK, you
> can't mount those.  Did you mean "..s1a"?

Once in the FixIt CD, I did a `ls /dev`. It shows the following:

ad0
ad0s1
ad0s1a
ad0s1b
ad0s1c
ad0s1e
ad0s1f
ad1
ad1s1
ad1s1c
ad1s1d

I try to mount one of the slices like this:  `mount /dev/ad0s1 /mount`

I `ls /mount` and get what appeared to be my old / directory. Then, when 
I do a `ls` on /dev after mounting, I only see ad0s1, not the rest on ad0.

> I don't know if it would help for us to know what you had and what you
> did and what you now have, but I can tell you that what you told us
> left me with many questions.

I'm one to explain things in full and complete detail, but I didn't want 
to type out a huge thing that would be too much for someone to read. But 
here is the long version:

Starting out, I have 4 hard drives all in NTFS format from when this 
machine ran Windows XP. I wanted to get them all in to UFS to use them 
with FreeBSD since I know there is only read support in NTFS...and 
because I don't plan to go back to Windows.

To hold the data temporarily while I format and partition the drives in 
to UFS, I bought a new 160GB hard drive and installed FreeBSD 
5.4-RELEASE on it.

So Friday, I pick a drive to start with, an 80GB drive. I copied all the 
data off that drive to a directory on the 160GB drive. I checksum it to 
make sure it is all there. I then used sysinstall to fdisk and disklabel 
it as per the instructions in the handbook pages here:

http://www.freebsd.org/doc/en_US.ISO8859-1/articles/formatting-media/x76.htm
l
http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/disks-adding.html

I got the 80GB drive in to UFS and had it all mounted in FreeBSD. I was 
ready to copy all my data back to the drive, and immediately when I 
started, I got several DMA write errors. I posted to the list about 
those, and people (including yourself) posted replies to help me (thanks 
for the reply on that one by the way).

I made the suggestion that I could try another one of my drives the same 
way to see if I got DMA errors to try to narrow down the problem. So 
last night, I put in this 60GB drive, copied the data off, and 
checksummed it. It checked out OK.

This morning, I go and format the drive with the Maxtor MaxBlast utility 
to start clean, since I knew it was heavily fragmented, and just wanted 
to have a fresh start. After formatting, I went into sysinstall to 
repeat the same process to fdisk and disklabel it.

I first went in to fdisk and told it to use the entire disk. Before I 
did ANYTHING, I read the top where it said "Modifying ad1" to confirm I 
wasn't modifying the wrong drive. Then, I said "a" to use the entire 
disk, and the changes took place on the display. I told it to write the 
changes. Then it asked about bootloaders, and I said none.

I went into the disklabel editor next. Nothing was showing there, just 
as before when doing the other drive on Friday. I used "c" to create 
new, told it the size, called it a filesystem, and told it a mountpoint. 
I then told it to write, and it showed the newfs process on the drive.

I then rebooted, only to find FreeBSD wasn't booting.

> What you should do depends on how important your data is to you.
> 
> Unfortunately, you now have two copies of your data and you don't
> know which disk, if any, you'll be able to recover it from, if any.
> 
> Ideally, you'd never write to either disk again until you get your
> data back in good form.  Pick a disk (or both) and copy it to other
> mediums for backup.  And copy it to a new disk which is at least as
> big and has the same Heads & Sectors values so any software won't know
> it's on a new disks after you copy it over with "dd" (using a
> blocksize = Heads*Sectors*512, usually).  Then try to fix THAT disk.
> Replace the MBR so the primary partitions match the data (if you can
> remember it). Replace the BSD labels so they secondary partitions
> match the data (if you can remember them).  If you can't remember the
> old layouts, I think you're stuck with a tough salvage job that will
> only be partially successful, by running raw disk blocks into a
> binary editor or Emacs and saving what you recognize into new files.
> No fun.  Or hiring a very expensive recovery expert.  IIRC, there are
> some hacky tools around to help do this; it's a near-FAQ and you might
> find something with a web search.

I guess I didn't explain before that I actually formatted the 60GB 
drive. I now see that was a mistake, but I guess hindsight is 20/20. So 
unfortunately that means I don't have two copies of the data, but 
hopefully I still have the one.

I don't have any "programs" on it really that I'm worried about, only 
Windows programs that are not important now anyway. The only programs 
are on the 160GB drive, and I was planning to reinstall FreeBSD anyway 
once my data was all copied over and drives converted to UFS.

My data consists of documents, email inbox files with years of email, 
music productions, video projects, websites, and other stuff I have done 
over the last several years. While much of the data is priceless, most 
of it is non profit so I don't have thousands of dollars for data 
recovery experts. Hopefully we can figure something out.

> AFAIK, you haven't yet done anything that actually ruined your file
> data blocks, unless you've put a BSD label (and boostrap) where it
> didn't used to be.
> 
> Good luck.

That's good to hear. I really do hope that is the case.

Thanks very much for your help so far, I really appreciate your time.

-Mark

_______________________________________________
freebsd-questions at freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscribe at freebsd.org"


-- 
No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.338 / Virus Database: 267.10.1/64 - Release Date: 08/04/2005

-- 
No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.338 / Virus Database: 267.10.1/64 - Release Date: 08/04/2005
 

-- 
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.338 / Virus Database: 267.10.1/64 - Release Date: 08/04/2005