hard drive failure: file recovery forensics

Paul Beard paulbeard at gmail.com
Sat Mar 29 23:13:26 UTC 2014


I have a disk I assume is bad, as smartctl tells me it is. The system it was the root drive for crashed last night and I don’t have any evidence it was the drive but I’m working with that assumption. 

Smartd is logging these: 
Mar 28 03:04:13 shuttle smartd[2086]: Device: /dev/ad2, 1 Currently unreadable (pending) sectors

Smartctl reveals this: 
  40 51 00 ee 6a d1 e1  Error: UNC at LBA = 0x01d16aee = 30501614

though no other test (the bad_blocks_scan script, for example) will find anything wrong. recoverdisk seems to be able to read that block just fine as I used it to clone the drive to a backup to boot from. 

What I have been looking for is someway to find whatever file is on the part of the disk so I can find out what I am going to be missing and to verify that smartd knows what it’s talking about. 

I have read many HOWTOs on locating that block and from there, getting the inode and the file. But none of them get me very far. fsdb doesn’t seem to like what I tell it. 

bsdlabel gives me this: 
# /dev/ad2s1:
8 partitions:
#          size     offset    fstype   [fsize bsize bps/cpg]
  a:    1048576          0    4.2BSD        0     0     0
  b:    4126336    1048576      swap                    
  c:  976773105          0    unused        0     0     # "raw" part, don't edit
  d:   10485760    5174912    4.2BSD        0     0     0
  e:    4194304   15660672    4.2BSD        0     0     0
  f:  956918129   19854976    4.2BSD        0     0     0

From there I take the offset of the slice and the partition to get the block relative to the start of the partition:

echo "(30501614 - (19854976 - 63))" | bc 
10646701

But then I seem to be stuck. 
fsdb -r /dev/ad2s1f
[…]
fsdb (inum: 2)> findblk 10646701 [time passes] 
fsdb (inum: 2)> 

Is there an extra step I need to take? 


More information about the freebsd-questions mailing list