Can't mount existing data disk after upgrade (disklabel gone)

Fri Jan 20 10:55:42 PST 2006

Joe S wrote:
> First of all, I have learned something VERY important about FreeBSD. 
> SAVE your DISKLABELS!
> 
> I have 2 drives in my home file server. One 80GB drive (ad0) for the OS 
> and one 300 GB drive for my data. A few days ago, I performed a clean 
> install of FreeBSD 6.0 on the 1st drive (ad0). After the install I tried 
> to mount ad4, but could not. I read somewhere that I was supposed to 
> save my disklabels. DOH! I did not do this, nor have I ever read about 
> this in the FreeBSD handbook.
> 
> After reading through the handbook and googling, I found a tool called 
> scan_ffs that can help me recreate my disklabels by scanning my drive 
> for partitions. Great!
> 
> Here is the output of scan_ffs on ad4:
>  root at coruscant# scan_ffs -l  /dev/ad4
>  X: 584002180 2097215 4.2BSD 2048 16384 0 # /data
> 
> Good. That is my /data partition. Its UFS2, created in FBSD 5.4.
> Next, I tried editing the disklabel. It starts out like this:
>  # /dev/ad4s1:
>  8 partitions:
>  #        size   offset    fstype   [fsize bsize bps/cpg]
> 
>    a: 586099316       16    unused        0     0
>    c: 586099332        0    unused        0     0
> 
> I changed it to this:
>  # /dev/ad4s1:
>  8 partitions:
>  #        size   offset    fstype   [fsize bsize bps/cpg]
>   a: 584002180 2097215 4.2BSD 2048 16384 0 # /data
>   c: 586099332        0    unused        0     0
> 
> But, I get this error:
>  partition a: partition extends past end of unit
>  re-edit the label? [y]:
> 
> Here is the output of bsdlabel. Notice the different sizes:
>  root at coruscant# bsdlabel -r ad4
>  # /dev/ad4:
>  8 partitions:
>  #        size   offset    fstype   [fsize bsize bps/cpg]
>    a: 586114688       16    unused        0     0
>    c: 586114704        0    unused        0     0
>  root at coruscant# bsdlabel -r ad4s1
>  # /dev/ad4s1:
>  8 partitions:
>  #        size   offset    fstype   [fsize bsize bps/cpg]
>    a: 586099316       16    unused        0     0
>    c: 586099332        0    unused        0     0
>  root at coruscant#
>  root at coruscant# bsdlabel -r ad4s1a
>  # /dev/ad4s1a:
>  8 partitions:
>  #        size   offset    fstype   [fsize bsize bps/cpg]
>    a: 586099300       16    unused        0     0
>    c: 586099316        0    unused        0     0
> 
> When I try to mount /dev/ad4s1a to /data, I get this error:
>  coruscant# mount /dev/ad4s1a /mnt
>  mount: /dev/ad4s1a on /mnt: incorrect super block
> 
> How can I properly re-create the disklabel? It seems this is what I need 
> to do in order to get to my data. Any help would be greatly appreciated.
> 
> -joe
> 
> 
> PS> Here is my dmesg:
> 
> Copyright (c) 1992-2005 The FreeBSD Project.
> Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
>         The Regents of the University of California. All rights reserved.
> FreeBSD 6.0-SECURITY #0: Mon Dec 19 23:46:33 UTC 2005
>     root at builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC
> ACPI APIC Table: <INTEL  D865PERL>
> Timecounter "i8254" frequency 1193182 Hz quality 0
> CPU: Intel(R) Pentium(R) 4 CPU 2.40GHz (2394.01-MHz 686-class CPU)
>   Origin = "GenuineIntel"  Id = 0xf29  Stepping = 9
> 
> Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE> 
> 
>   Features2=0x4400<CNTX-ID,<b14>>
> real memory  = 1072889856 (1023 MB)
> avail memory = 1040945152 (992 MB)
> ioapic0 <Version 2.0> irqs 0-23 on motherboard
> npx0: [FAST]
> npx0: <math processor> on motherboard
> npx0: INT 16 interface
> acpi0: <INTEL D865PERL> on motherboard
> acpi0: Power Button (fixed)
> pci_link0: <ACPI PCI Link LNKA> irq 11 on acpi0
> pci_link1: <ACPI PCI Link LNKB> irq 3 on acpi0
> pci_link2: <ACPI PCI Link LNKC> irq 10 on acpi0
> pci_link3: <ACPI PCI Link LNKD> irq 5 on acpi0
> pci_link4: <ACPI PCI Link LNKE> irq 0 on acpi0
> pci_link5: <ACPI PCI Link LNKF> irq 0 on acpi0
> pci_link6: <ACPI PCI Link LNKG> irq 9 on acpi0
> pci_link7: <ACPI PCI Link LNKH> irq 9 on acpi0
> Timecounter "ACPI-fast" frequency 3579545 Hz quality 1000
> acpi_timer0: <24-bit timer at 3.579545MHz> port 0x408-0x40b on acpi0
> cpu0: <ACPI CPU> on acpi0
> acpi_throttle0: <ACPI CPU Throttling> on cpu0
> pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
> pci0: <ACPI PCI bus> on pcib0
> agp0: <Intel 82865 host to AGP bridge> mem 0xf8000000-0xfbffffff at 
> device 0.0 on pci0
> pcib1: <ACPI PCI-PCI bridge> at device 1.0 on pci0
> pci1: <ACPI PCI bus> on pcib1
> pci1: <display, VGA> at device 0.0 (no driver attached)
> uhci0: <Intel 82801EB (ICH5) USB controller USB-A> port 0xcc00-0xcc1f 
> irq 16 at device 29.0 on pci0
> uhci0: [GIANT-LOCKED]
> usb0: <Intel 82801EB (ICH5) USB controller USB-A> on uhci0
> usb0: USB revision 1.0
> uhub0: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
> uhub0: 2 ports with 2 removable, self powered
> uhci1: <Intel 82801EB (ICH5) USB controller USB-B> port 0xd000-0xd01f 
> irq 19 at device 29.1 on pci0
> uhci1: [GIANT-LOCKED]
> usb1: <Intel 82801EB (ICH5) USB controller USB-B> on uhci1
> usb1: USB revision 1.0
> uhub1: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
> uhub1: 2 ports with 2 removable, self powered
> uhci2: <Intel 82801EB (ICH5) USB controller USB-C> port 0xd400-0xd41f 
> irq 18 at device 29.2 on pci0
> uhci2: [GIANT-LOCKED]
> usb2: <Intel 82801EB (ICH5) USB controller USB-C> on uhci2
> usb2: USB revision 1.0
> uhub2: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
> uhub2: 2 ports with 2 removable, self powered
> uhci3: <Intel 82801EB (ICH5) USB controller USB-D> port 0xd800-0xd81f 
> irq 16 at device 29.3 on pci0
> uhci3: [GIANT-LOCKED]
> usb3: <Intel 82801EB (ICH5) USB controller USB-D> on uhci3
> usb3: USB revision 1.0
> uhub3: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
> uhub3: 2 ports with 2 removable, self powered
> ehci0: <EHCI (generic) USB 2.0 controller> mem 0xfebffc00-0xfebfffff irq 
> 23 at device 29.7 on pci0
> ehci0: [GIANT-LOCKED]
> usb4: EHCI version 1.0
> usb4: companion controllers, 2 ports each: usb0 usb1 usb2 usb3
> usb4: <EHCI (generic) USB 2.0 controller> on ehci0
> usb4: USB revision 2.0
> uhub4: Intel EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
> uhub4: 8 ports with 8 removable, self powered
> pcib2: <ACPI PCI-PCI bridge> at device 30.0 on pci0
> pci2: <ACPI PCI bus> on pcib2
> atapci0: <Promise PDC20270 UDMA100 controller> port 
> 0xbc00-0xbc07,0xb800-0xb803,0xb400-0xb407,0xb000-0xb003,0xac00-0xac0f 
> mem 0xfeaf0000-0xfeafffff irq 22 at device 1.0 on pci2
> ata2: <ATA channel 0> on atapci0
> ata3: <ATA channel 1> on atapci0
> ahc0: <Adaptec 2940 Ultra2 SCSI adapter> port 0xa800-0xa8ff mem 
> 0xfeadf000-0xfeadffff irq 17 at device 2.0 on pci2
> ahc0: [GIANT-LOCKED]
> aic7890/91: Ultra2 Wide Channel A, SCSI Id=7, 32/253 SCBs
> fxp0: <Intel 82559 Pro/100 Ethernet> port 0xa400-0xa43f mem 
> 0xfeade000-0xfeadefff,0xfe900000-0xfe9fffff irq 18 at device 4.0 on pci2
> miibus0: <MII bus> on fxp0
> inphy0: <i82555 10/100 media interface> on miibus0
> inphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
> fxp0: Ethernet address: 00:d0:b7:9f:dd:0f
> isab0: <PCI-ISA bridge> at device 31.0 on pci0
> isa0: <ISA bus> on isab0
> atapci1: <Intel ICH5 UDMA100 controller> port 
> 0x1f0-0x1f7,0x3f6,0x170-0x177,0x376,0xffa0-0xffaf at device 31.1 on pci0
> ata0: <ATA channel 0> on atapci1
> ata1: <ATA channel 1> on atapci1
> atapci2: <Intel ICH5 SATA150 controller> port 
> 0xec00-0xec07,0xe800-0xe803,0xe400-0xe407,0xe000-0xe003,0xdc00-0xdc0f 
> irq 18 at device 31.2 on pci0
> atapci2: failed to enable memory mapping!
> ata4: <ATA channel 0> on atapci2
> ata5: <ATA channel 1> on atapci2
> pci0: <serial bus, SMBus> at device 31.3 (no driver attached)
> acpi_button0: <Sleep Button> on acpi0
> atkbdc0: <Keyboard controller (i8042)> port 0x60,0x64 irq 1 on acpi0
> atkbd0: <AT Keyboard> irq 1 on atkbdc0
> kbd0 at atkbd0
> atkbd0: [GIANT-LOCKED]
> sio0: configured irq 4 not in bitmap of probed irqs 0
> sio0: port may not be enabled
> sio0: <16550A-compatible COM port> port 0x3f8-0x3ff irq 4 flags 0x10 on 
> acpi0
> sio0: type 16550A
> ppc0: <Standard parallel printer port> port 0x378-0x37f irq 7 on acpi0
> ppc0: Generic chipset (NIBBLE-only) in COMPATIBLE mode
> ppbus0: <Parallel port bus> on ppc0
> plip0: <PLIP network interface> on ppbus0
> lpt0: <Printer> on ppbus0
> lpt0: Interrupt-driven port
> ppi0: <Parallel I/O> on ppbus0
> pmtimer0 on isa0
> orm0: <ISA Option ROMs> at iomem 
> 0xc0000-0xcf7ff,0xcf800-0xd7fff,0xd8000-0xd87ff,0xd8800-0xd9fff,0xda000-0xdafff 
> on isa0
> sc0: <System console> at flags 0x100 on isa0
> sc0: VGA <16 virtual consoles, flags=0x300>
> sio1: configured irq 3 not in bitmap of probed irqs 0
> sio1: port may not be enabled
> vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
> Timecounter "TSC" frequency 2394008600 Hz quality 800
> Timecounters tick every 1.000 msec
> Waiting 5 seconds for SCSI devices to settle
> ad0: 76319MB <WDC WD800JB-00CRA1 17.07W17> at ata0-master UDMA100
> acd0: CDROM <CDU5211/YYS7> at ata1-master UDMA33
> ad4: 286188MB <Maxtor 6B300R0 BAH41B70> at ata2-master UDMA100
> ad4: Promise subdisks has no flags
> sa0 at ahc0 bus 0 target 0 lun 0
> sa0: <SONY SDX-300C 0300> Removable Sequential Access SCSI-2 device
> sa0: 20.000MB/s transfers (10.000MHz, offset 15, 16bit)
> Trying to mount root from ufs:/dev/ad0s1a
> 

Wonderful. In trying to recreate the disklabel, i was unaware that 
sysinstall would also try to format it. It re-formatted my drive. I 
stopped it after 3 seconds when I realized what was happening.

Can someone please add this to the handbook?

Also, can someone recommend some good forensics tools?