Help with external HD and reiserfs

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
inodehunter
Posts: 2
Joined: 24 May 2013, 17:03

Help with external HD and reiserfs

#1 Post by inodehunter »

Long story short, the start of an external USB HD with reiserfs was clobbered by a util meant to copy linux images to flash drives (i.e. it created a FAT32 partition at the start of the disk.) Previous to this, the disk had only one large linux partition -- In my haste, I recreated the original partition type/size, believing the usual disk check *might* be able to recover/rebuild, but it did not.

That said, I'm trying to figure out how to rebuild/rescue what was on that drive. Running 'testdisk' shows the 'older' FAT partition, but also hints of my original partition (that I recognize by disk label.) Alas, it also says, 'the following partition can't be recovered..." What is it 'testdisk' is seeing that makes it decide not to offer up option to select that partition data to restore?

As an aside, I've cloned the disk using 'ddrescue' and I get the same error message (meaning, I'm optimistic about working with the cloned drive instead of the original.) I'm guessing that I need to somehow rebuild the superblock, but my original attempt to do this failed -- I believe it was because I was using an incorrect offset/block size.

Any tips/help would be greatly appreciated.

inodehunter
Posts: 2
Joined: 24 May 2013, 17:03

Re: Help with external HD and reiserfs

#2 Post by inodehunter »

I have recovered! Most of it, anyway...

I came across an article on another forum that provided the key, and I feel obligated to share -- I am also compelled to express my gratitude to the authors of 'testdisk/photorec', and 'parted', that were crucial in the recovery. PhotoRec was phenomenal at pulling files out of my "damaged" drive, but it also produced more than 6 million of them -- Pretty daunting to try and sort through them all. I'd also tried a few commercial apps that claimed to be able to recover ReiserFS filesystems, and none of them even hinted at being able to recover my data.

In any case, below is what my initial 'testdisk' run looked like:
testdisk-1.png
testdisk-1.png (71.26 KiB) Viewed 2189 times
On deeper ('Quicker') search, the partition I was after showed up in the list ('bfdisk'):
testdisk-2.png
testdisk-2.png (61.45 KiB) Viewed 2189 times
Unfortunately, it told me it couldn't recover the partition:
testdisk-3.png
testdisk-3.png (69.06 KiB) Viewed 2189 times
Even after I manually added the partition to the list using the CHS values produced, it did not identify any files in the partition.


-- The Repair --

Per my previous post, it was unclear why 'testdisk' said the partition couldn't be recovered. It found it, after all, and even produced the label -- It wasn't clear why I couldn't simply select it.

Again, my case was fairly simple in that I had one large partition -- I might not recommend the solution below to someone with multiple partitions (and I definitely recommend working with an image/cloned drive via 'ddrescue', if at all possible.)

This other article suggested deleting the partition table, and recreating it using 'parted'. I used 'testdisk' to delete the partition table (making note of the CHS values it found for my target partition), and then fired up 'parted'.

The second step was to create a base table using 'mktable msdos' -- Seemed odd to choose 'msdos' for Linux partitions, but that was the recommendation.

The third step was to use 'parted's 'rescue' command. This is where it got interesting: I used the same CHS values produced by 'testdisk', i.e. 'rescue 1,2,1 121602,0,61', and it told me this was past the end of the drive. Note that this is what 'testdisk' found as a *legacy* entry -- If you look at the screenshots again, it cites the end of the drive as '121601 255 63'. As I was about to put this value in, I observed 'rescue' has a switch for exactly the last sector: -1s

The rescue command then became, 'rescue 1,2,1 -1s' -- Upon entering this, 'parted' reported having found a reiserfs primary partition, and asked whether I wanted to add it to the table. A 'Yes', 'quit' and 'reiserfsck' later, the bulk of my data was back!

After a month and a half of trying to find some way to at least partially recover from my mistake, 'testdisk', and 'parted' made it happen (along with the advice of a few kind Netizens, who cared enough to try and help others.)

Perhaps this helps somebody else...

Locked