Looking for help to reconstruct a corrupted UFS2 filesystem

[Matt Emmerton]

Hi folks,

Before anyone points out the obvious, yes, I did take backups.  For reasons 
I won't get into here, the backup filesystem got symlinked to a location on 
the source drive (mere hours before the drive crapped out), which rendered 
my backups useless.

The drive containing the corrupted filesystem is detected as ad1.  This 
drive has two *different* partition tables on it -- /dev/ad1 shows a NTFS 
filesystem using the whole disk, and /dev/ad1s1 shows a FreeBSD filesystem 
using the whole disk.  I mistakenly thought this was a disk that I had 
brought over from a Windows machine and proceeded to boot Windows and 
"repaired" the NTFS filesystem.  Oops.

After that failed, I realized that the disk really contained a FreeBSD 
filesystem on /dev/ad1s1.  Attempts to reconstruct this have failed 
miserably.

Using newfs -N, I located alternate superblocks.  The majority of the 
superblocks are identical, with a couple being corrupted or all-zeros 
(including the primary superblock at 160).  Using dd I copied a "good" 
superblock over all of the "bad" superblocks, and now all superblocks 
contain the same information.

Now, using fsck_ufs -b <sb> /dev/ad1s1, it churns away, and eventually 
brings up some garbage data and fails attempting to allocate 4GB of memory. 
(See attached file - fsck.out).

What are my options at this point?  Since all the superblocks are identical, 
fsck always behaves the same.  I suspect that one of the key blocks that the 
superblock points to is corrupted.  Is any of this data replicated on disk? 
Can I troll the disk looking for intermediate blocks and easily chain 
together portions of directory trees?

Regards,
--
Matt Emmerton 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: fsck.out
Type: application/octet-stream
Size: 478 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-fs/attachments/20080120/2accfaf7/fsck.obj