Superblocks and partitions on a Linux drive

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
kbarb
Posts: 6
Joined: 13 Mar 2012, 01:28

Superblocks and partitions on a Linux drive

#1 Post by kbarb »

Hi,
I was wondering if someone could take a quick look at my Testdisk logs for Analyse, Quick Search and Deeper Search.
I've actually solved the problem but am hoping for a little clarification.

This a friend's Fujitsu drive on which he was running Debian Linux. Something went wrong and he couldn't mount the last (#9) partition where all his files were. I already recovered the files using Testdisk, finding a partition and doing "Write" - so thanks already !

I annotated the following testdisk.log - divided it into sections so I could make sense of it.
But I put a question in it about half way down, then another question at the end.
It's a question about ". . . .Sparse superblock Recover" - see middle of file in color :

Also I was wondering if you see anything wrong that jumps out at you. It appears all the partitions are where they are supposed to be, but there are a lot of deleted ones because when he was setting up the computer he was playing around with the partition structure a bit.

Here is the log file :

Fri Mar 16 02:34:53 2012
Command line: TestDisk

===================================================================
ANALYSE
===================================================================
TestDisk 6.12-WIP, Data Recovery Utility, April 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

OS: Linux, kernel 2.6.38.4-pmagic (#1 SMP Tue Apr 26 13:28:55 CDT 2011) i686
Compiler: GCC 4.4 - Jan 28 2010 17:08:34
ext2fs lib: 1.41.14, ntfs lib: 10:0:0, reiserfs lib: 0.3.0.5, ewf lib: none
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
===================================================================
THE FUJITSU DRV IS THE ONE THAT'S BEING ANALYSED - THE OWNER COULD NOT MOUNT THE LAST (#9) PARTITION
===================================================================
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - FUJITSU MJA2320BH G2
Disk /dev/sdb - 16 GB / 14 GiB - CHS 15296 64 32, sector size=512 - SMI USB DISK

Partition table type (auto): Intel
Disk /dev/sda - 320 GB / 298 GiB - FUJITSU MJA2320BH G2
Partition table type: Intel

Analyse Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Geometry from i386 MBR: head=255 sector=63
get_geometry_from_list_part_aux head=255 nbr=22
get_geometry_from_list_part_aux head=8 nbr=3
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=22
Current partition structure:
1 * Linux 0 1 1 181 254 63 2923767
2 E extended 182 0 1 38912 254 63 622213515
5 L Linux Swap 182 1 1 424 254 63 3903732
X extended 425 0 1 667 254 63 3903795
6 L Linux 425 1 1 667 254 63 3903732
X extended 668 0 1 1093 254 63 6843690
7 L Linux 668 1 1 1093 254 63 6843627
X extended 1094 0 1 1822 254 63 11711385
8 L Linux 1094 1 1 1822 254 63 11711322
X extended 1823 0 1 38912 254 63 595850850
9 L Linux 1823 1 1 38912 254 63 595850787

===================================================================
QUICK SEARCH
===================================================================
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sda - 320 GB / 298 GiB - CHS 38914 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38914 255 63

recover_EXT2: s_block_group_nr=0/11, s_mnt_count=37/32, s_blocks_per_group=32768, s_inodes_per_group=7616
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 365470
recover_EXT2: part_size 2923760
Linux 0 1 1 181 254 56 2923760
EXT3 Large file Sparse superblock, 1496 MB / 1427 MiB
Linux Swap 182 0 1 424 254 44 3903776
SWAP2 version 1, 1998 MB / 1906 MiB

recover_EXT2: s_block_group_nr=0/14, s_mnt_count=1/37, s_blocks_per_group=32768, s_inodes_per_group=8144
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 487974
recover_EXT2: part_size 3903792
Linux 425 0 1 667 254 60 3903792
EXT3 Large file Sparse superblock Recover, 1998 MB / 1906 MiB

recover_EXT2: s_block_group_nr=0/26, s_mnt_count=21/23, s_blocks_per_group=32768, s_inodes_per_group=7936
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 855453
recover_EXT2: part_size 6843624
Linux 668 1 1 1093 254 60 6843624
EXT3 Large file Sparse superblock, 3503 MB / 3341 MiB

recover_EXT2: s_block_group_nr=0/44, s_mnt_count=14/26, s_blocks_per_group=32768, s_inodes_per_group=8144
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1463915
recover_EXT2: part_size 11711320
Linux 1094 1 1 1822 254 61 11711320
EXT3 Large file Sparse superblock, 5996 MB / 5718 MiB

recover_EXT2: s_block_group_nr=0/2272, s_mnt_count=29/34, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 74481348
recover_EXT2: part_size 595850784
Linux 1823 1 1 38912 254 60 595850784
EXT3 Large file Sparse superblock, 305 GB / 284 GiB
get_geometry_from_list_part_aux head=255 nbr=12
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=12

Results
* Linux 0 1 1 181 254 63 2923767
EXT3 Large file Sparse superblock, 1496 MB / 1427 MiB
P Linux Swap 182 0 1 424 254 63 3903795
SWAP2 version 1, 1998 MB / 1906 MiB
P Linux 425 0 1 667 254 63 3903795
EXT3 Large file Sparse superblock Recover, 1998 MB / 1906 MiB
L Linux 668 1 1 1093 254 63 6843627
EXT3 Large file Sparse superblock, 3503 MB / 3341 MiB
L Linux 1094 1 1 1822 254 63 11711322
EXT3 Large file Sparse superblock, 5996 MB / 5718 MiB
L Linux 1823 1 1 38912 254 63 595850787
EXT3 Large file Sparse superblock, 305 GB / 284 GiB


===================================================================
DEEPER SEARCH
===================================================================
interface_write()
1 * Linux 0 1 1 181 254 63 2923767
2 P Linux Swap 182 0 1 424 254 63 3903795
3 P Linux 425 0 1 667 254 63 3903795
4 E extended LBA 668 0 1 38913 254 63 614421990
5 L Linux 668 1 1 1093 254 63 6843627
6 L Linux 1094 1 1 1822 254 63 11711322
7 L Linux 1823 1 1 38912 254 63 595850787

search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38914 255 63

recover_EXT2: s_block_group_nr=0/11, s_mnt_count=37/32, s_blocks_per_group=32768, s_inodes_per_group=7616
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 365470
recover_EXT2: part_size 2923760
Linux 0 1 1 181 254 56 2923760
EXT3 Large file Sparse superblock, 1496 MB / 1427 MiB

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/11, s_mnt_count=0/32, s_blocks_per_group=32768, s_inodes_per_group=7616
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 365470
recover_EXT2: part_size 2923760
Linux 0 1 1 181 254 56 2923760
EXT3 Large file Sparse superblock Backup superblock, 1496 MB / 1427 MiB
Linux Swap 182 0 1 424 254 44 3903776
SWAP2 version 1, 1998 MB / 1906 MiB
Linux Swap 182 1 1 424 254 43 3903712
SWAP2 version 1, 1998 MB / 1906 MiB

===================================================================
THE NEXT SIX LINES :

1. Where it says "EXT3 Large file Sparse superblock Recover (below), 1998 MB / 1906 MiB"
. . . that means Testdisk found a backup Superblock that could be recovered ?
The previous & next six lines don't end with "superblock Recover", just "superblock."

In general - that's what all these are ? . . . backup superblocks that Testdisk found, that could be recovered ?


===================================================================

recover_EXT2: s_block_group_nr=0/14, s_mnt_count=1/37, s_blocks_per_group=32768, s_inodes_per_group=8144
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 487974
recover_EXT2: part_size 3903792
Linux 425 0 1 667 254 60 3903792
EXT3 Large file Sparse superblock Recover, 1998 MB / 1906 MiB

recover_EXT2: s_block_group_nr=0/14, s_mnt_count=19/20, s_blocks_per_group=32768, s_inodes_per_group=8144
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 487966
recover_EXT2: part_size 3903728
Linux 425 1 1 667 254 59 3903728
EXT3 Large file Sparse superblock, 1998 MB / 1906 MiB

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/14, s_mnt_count=0/20, s_blocks_per_group=32768, s_inodes_per_group=8144
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 487966
recover_EXT2: part_size 3903728
Linux 425 1 1 667 254 59 3903728
EXT3 Large file Sparse superblock Backup superblock, 1998 MB / 1906 MiB

recover_EXT2: s_block_group_nr=0/14, s_mnt_count=12/20, s_blocks_per_group=32768, s_inodes_per_group=8144
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 487966
recover_EXT2: part_size 3903728
Linux 523 210 8 766 209 3 3903728
EXT3 Large file Sparse superblock Recover, 1998 MB / 1906 MiB

recover_EXT2: s_block_group_nr=0/14, s_mnt_count=12/20, s_blocks_per_group=32768, s_inodes_per_group=8144
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 487966
recover_EXT2: part_size 3903728
Linux 524 247 44 767 246 39 3903728
EXT3 Large file Sparse superblock Recover, 1998 MB / 1906 MiB

recover_EXT2: s_block_group_nr=0/14, s_mnt_count=12/20, s_blocks_per_group=32768, s_inodes_per_group=8144
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 487966
recover_EXT2: part_size 3903728
Linux 525 252 48 768 251 43 3903728
EXT3 Large file Sparse superblock Recover, 1998 MB / 1906 MiB

recover_EXT2: s_block_group_nr=0/26, s_mnt_count=21/23, s_blocks_per_group=32768, s_inodes_per_group=7936
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 855453
recover_EXT2: part_size 6843624
Linux 668 1 1 1093 254 60 6843624
EXT3 Large file Sparse superblock, 3503 MB / 3341 MiB

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/26, s_mnt_count=0/23, s_blocks_per_group=32768, s_inodes_per_group=7936
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 855453
recover_EXT2: part_size 6843624
Linux 668 1 1 1093 254 60 6843624
EXT3 Large file Sparse superblock Backup superblock, 3503 MB / 3341 MiB

recover_EXT2: s_block_group_nr=0/26, s_mnt_count=15/23, s_blocks_per_group=32768, s_inodes_per_group=7936
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 855453
recover_EXT2: part_size 6843624
Linux 868 1 1 1293 254 60 6843624
EXT3 Large file Sparse superblock Recover, 3503 MB / 3341 MiB

recover_EXT2: s_block_group_nr=0/26, s_mnt_count=15/23, s_blocks_per_group=32768, s_inodes_per_group=7936
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 855453
recover_EXT2: part_size 6843624
Linux 869 2 1 1295 0 60 6843624
EXT3 Large file Sparse superblock Recover, 3503 MB / 3341 MiB

recover_EXT2: s_block_group_nr=0/44, s_mnt_count=14/26, s_blocks_per_group=32768, s_inodes_per_group=8144
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1463915
recover_EXT2: part_size 11711320
Linux 1094 1 1 1822 254 61 11711320
EXT3 Large file Sparse superblock, 5996 MB / 5718 MiB

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/44, s_mnt_count=0/26, s_blocks_per_group=32768, s_inodes_per_group=8144
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1463915
recover_EXT2: part_size 11711320
Linux 1094 1 1 1822 254 61 11711320
EXT3 Large file Sparse superblock Backup superblock, 5996 MB / 5718 MiB

recover_EXT2: s_block_group_nr=0/2272, s_mnt_count=29/34, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 74481348
recover_EXT2: part_size 595850784
Linux 1823 1 1 38912 254 60 595850784
EXT3 Large file Sparse superblock, 305 GB / 284 GiB

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/2272, s_mnt_count=0/34, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 74481348
recover_EXT2: part_size 595850784
Linux 1823 1 1 38912 254 60 595850784
EXT3 Large file Sparse superblock Backup superblock, 305 GB / 284 GiB

recover_EXT2: s_block_group_nr=0/2272, s_mnt_count=19/34, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 74481348
recover_EXT2: part_size 595850784
Linux 20350 0 1 57439 253 60 595850784
EXT3 Large file Sparse superblock Recover, 305 GB / 284 GiB
This partition ends after the disk limits. (start=326922750, size=595850784, end=922773533, disk end=625153410)
Disk /dev/sda - 320 GB / 298 GiB - CHS 38914 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (320 GB / 298 GiB) seems too small! (< 472 GB / 440 GiB)
The following partition can't be recovered:
Linux 20350 0 1 57439 253 60 595850784
EXT3 Large file Sparse superblock Recover, 305 GB / 284 GiB
get_geometry_from_list_part_aux head=255 nbr=18
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=18

Results
* Linux 0 1 1 181 254 63 2923767
EXT3 Large file Sparse superblock, 1496 MB / 1427 MiB
Linux Swap 182 0 1 424 254 63 3903795
SWAP2 version 1, 1998 MB / 1906 MiB
Linux Swap 182 1 1 424 254 63 3903732
SWAP2 version 1, 1998 MB / 1906 MiB
Linux 425 0 1 667 254 63 3903795
EXT3 Large file Sparse superblock Recover, 1998 MB / 1906 MiB
Linux 425 1 1 667 254 63 3903732
EXT3 Large file Sparse superblock, 1998 MB / 1906 MiB
Linux 523 210 8 766 254 63 3906623
EXT3 Large file Sparse superblock Recover, 2000 MB / 1907 MiB
Linux 524 247 44 767 254 63 3904256
EXT3 Large file Sparse superblock Recover, 1998 MB / 1906 MiB
Linux 525 252 48 768 254 63 3903937
EXT3 Large file Sparse super

===================================================================

(I think I cut off the last lines above - the screen shot below should show the results . . . )

===================================================================

Here is the result of the Deeper Search.
Is that last line in green . . . "L Linux . . . . . . . . cyl 1823 . . . .
Is that the same partition as in the Quick Search result (below in the second screen shot) or is that the result of a found disk signature ? I'm just wondering why it showed up in Deeper Search.


Image

The result of the first Quick Search - and this is how the partitions should look, as far as I know :
Image

So that's two questions plus one more :

1. about the "superblock recover" in the log.

2. if the last (green) lines in the screenshots are the same partition

3. As I wrote above, all the partitions seem to be back, but anything really look obviously wrong besides all the "D" partitions ?

Thanks again

Locked