file system recovery
hannes at mehnert.org
Sat Oct 2 12:08:42 PDT 2004
-----BEGIN PGP SIGNED MESSAGE-----
I updatet yesterday to -CURRENT (from -CURRENT from about 09/20).
I use gbde, so I attached my gbde device (a partition, no md-device).
After mounting it I was not able to access files. An ls /mnt/crypto/
froze the system, I had to reboot.
After reboot fsck was not able to check the attached gbde device:
# fsck -t ufs /dev/ad0s2f.bde
** Last Mounted on /mnt/crypto
** Phase 1 - Check Blocks and Sizes
fsck_ufs: cannot alloc 2728847320 bytes for inoinfo
I downgraded to -CURRENT from 20040915, but it was also not able
to run fsck.
I also tried other superblocks (fsck -b), nothing changed, looks
like something else broke.
dumpfs core dumps (https://berlin.ccc.de/~hannes/dumpfs). I patched
dumpfs to ignore cg 1 (cause it contains invalid data), then it core
dumped at cg 2 (it had some other negative values in cg 2 nfree,..).
It looks like nbfree, ndir, nifree and nffree is in the cs struct.
Are there any tools to fix the file-system (with assumptions like
nbfree can't be negative)?
I tried sysutils/autopsy, but this was also not able to recover any
data. It returns "Out of memory during "large" request for 536875008
bytes, total sbrk() is 271708160 bytes at
/usr/ports/sysutils/autopsy/work/autopsy-1.73/autopsyfunc.pm line 2048."
Also the sysutils/sleuthkit toolset also does not work.
(Cannot allocate memory).
dd if=/dev/ad0s2f.bde bs=1m count=20 skip=32 | strings
returns data which is (was?) on the file system.
Any ideas how to recover the data (apart from shell-skripts which use
dd and strings)?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (FreeBSD)
-----END PGP SIGNATURE-----
More information about the freebsd-current