hard drive failure: file recovery forensics
Paul Beard
paulbeard at gmail.com
Sat Mar 29 23:13:26 UTC 2014
I have a disk I assume is bad, as smartctl tells me it is. The system it was the root drive for crashed last night and I don’t have any evidence it was the drive but I’m working with that assumption.
Smartd is logging these:
Mar 28 03:04:13 shuttle smartd[2086]: Device: /dev/ad2, 1 Currently unreadable (pending) sectors
Smartctl reveals this:
40 51 00 ee 6a d1 e1 Error: UNC at LBA = 0x01d16aee = 30501614
though no other test (the bad_blocks_scan script, for example) will find anything wrong. recoverdisk seems to be able to read that block just fine as I used it to clone the drive to a backup to boot from.
What I have been looking for is someway to find whatever file is on the part of the disk so I can find out what I am going to be missing and to verify that smartd knows what it’s talking about.
I have read many HOWTOs on locating that block and from there, getting the inode and the file. But none of them get me very far. fsdb doesn’t seem to like what I tell it.
bsdlabel gives me this:
# /dev/ad2s1:
8 partitions:
# size offset fstype [fsize bsize bps/cpg]
a: 1048576 0 4.2BSD 0 0 0
b: 4126336 1048576 swap
c: 976773105 0 unused 0 0 # "raw" part, don't edit
d: 10485760 5174912 4.2BSD 0 0 0
e: 4194304 15660672 4.2BSD 0 0 0
f: 956918129 19854976 4.2BSD 0 0 0
From there I take the offset of the slice and the partition to get the block relative to the start of the partition:
echo "(30501614 - (19854976 - 63))" | bc
10646701
But then I seem to be stuck.
fsdb -r /dev/ad2s1f
[…]
fsdb (inum: 2)> findblk 10646701 [time passes]
fsdb (inum: 2)>
Is there an extra step I need to take?
More information about the freebsd-questions
mailing list