Lost XFS/SysV partitions on external Western Digital drive
Posted: 29 Mar 2012, 20:00
A friend of mine asked me to take a look at his external hard drive because it suddenly wasn't mounting any longer. He had been running it with a power cord with exposed wires and the "enclosure" the hard drive lived in was a VHS case, filled with foam padding, and wrapped in electrical tape.
Yeah.
Apparently, it shut off randomly and now will no longer mount. He had said it was doing "the click of death" which I didn't hear, said but once each time you power the drive the read arm will smack into the stop, causing a single click. I believe this is because the partition is gone and the read arm has no idea where to start searching for data.
I didn't know what type of partition it was, and neither did he, so I ran an Intel-based analysis, which produced absolutely nothing. I then ran a Non Partitioned Media scan and it started finding XFS information. I've attached my log, but when it finished scanning sectors it told me the partitions could not be recovered.
I'm not sure where to go from here...
EDIT on Apr 2: Here is my dmesg | tail when trying to mount this drive:
[ 1486.877553] sd 5:0:0:0: [sdc] Mode Sense: 00 38 00 00
[ 1486.877565] sd 5:0:0:0: [sdc] Assuming drive cache: write through
[ 1486.879790] sd 5:0:0:0: [sdc] Assuming drive cache: write through
[ 1486.880028] sdc: unknown partition table
[ 1486.892570] sd 5:0:0:0: [sdc] Assuming drive cache: write through
[ 1486.892806] sd 5:0:0:0: [sdc] Attached SCSI disk
[ 1538.422662] SGI XFS with ACLs, security attributes, realtime, large block/inode numbers, no debug enabled
[ 1538.427689] SGI XFS Quota Management subsystem
[ 1538.429461] XFS: bad magic number
[ 1538.429471] XFS: SB validate failed
EDIT: Apparently I can't upload log files here... So here's a big dump! You'll also see at the end that I killed the program because it seemed to be trying to make me write an HFS+ partition to the drive, and i didn't know if that would be a bad idea or not.
Wed Mar 28 10:45:44 2012
Command line: TestDisk
TestDisk 6.11, Data Recovery Utility, April 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 2.6.32-5-amd64 (#1 SMP Thu Mar 22 17:26:33 UTC 2012)
Compiler: GCC 4.4 - Sep 5 2010 16:13:36
ext2fs lib: 1.41.12, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 488397168 sectors
/dev/sda: user_max 488397168 sectors
/dev/sda: native_max 488397168 sectors
/dev/sda: dco 488397168 sectors
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - ATA ST9250315AS
Disk /dev/sdb - 7969 MB / 7600 MiB - CHS 1020 246 62, sector size=512 - Multiple Card Reader
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10 EARS-00Y5B1
Partition table type (auto): Intel
Disk /dev/sdc - 1000 GB / 931 GiB - WDC WD10 EARS-00Y5B1
Partition table type: None
Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:
P Unknown 0 0 1 121601 80 63 1953525168
search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Unknown XFS version 0
XFS Marker at 22405/210/41
recover_xfs
XFS 4 22405 210 41 4292826805 248 41 9659776198511754 [--ç㦠FNE:Ã]
XFS 6.2+ - bitmap version, 4945805 TB / 4498183 TiB
This partition ends after the disk limits. (start=359949595, size=9659776198511754, end=9659776558461349, disk end=1953525168)
Unknown XFS version 0
XFS Marker at 34789/164/11
recover_xfs
XFS 4 34789 164 11 4292839189 202 11 9659776198511754 [--ç㦠FNE:Ã]
XFS 6.2+ - bitmap version, 4945805 TB / 4498183 TiB
This partition ends after the disk limits. (start=558895627, size=9659776198511754, end=9659776757407381, disk end=1953525168)
check_FAT: Bad jump in FAT partition
SYSV4 Marker at 65244/36/15
recover_sysv4
SysV 4 65244 36 15 223351 34 5 2539988820 [Å2.]
SysV4, 1300 GB / 1211 GiB
This partition ends after the disk limits. (start=1048147142, size=2539988820, end=3588135961, disk end=1953525168)
HFS+ magic value at 121599/170/24
part_size 9396
HFS+ 121599 170 24 121600 64 32 9396
HFS+, 4810 KB / 4698 KiB
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 4945805 TB / 4498184 TiB)
The following partitions can't be recovered:
XFS 4 22405 210 41 4292826805 248 41 9659776198511754 [--ç㦠FNE:Ã]
XFS 6.2+ - bitmap version, 4945805 TB / 4498183 TiB
XFS 4 34789 164 11 4292839189 202 11 9659776198511754 [--ç㦠FNE:Ã]
XFS 6.2+ - bitmap version, 4945805 TB / 4498183 TiB
SysV 4 65244 36 15 223351 34 5 2539988820 [Å2.]
SysV4, 1300 GB / 1211 GiB
Results
P HFS+ 121599 170 24 121600 64 32 9396
HFS+, 4810 KB / 4698 KiB
Change partition type:
P HFS+ 121599 170 24 121600 64 32 9396
HFS+, 4810 KB / 4698 KiB
SIGINT detected! TestDisk has been killed.
Yeah.
Apparently, it shut off randomly and now will no longer mount. He had said it was doing "the click of death" which I didn't hear, said but once each time you power the drive the read arm will smack into the stop, causing a single click. I believe this is because the partition is gone and the read arm has no idea where to start searching for data.
I didn't know what type of partition it was, and neither did he, so I ran an Intel-based analysis, which produced absolutely nothing. I then ran a Non Partitioned Media scan and it started finding XFS information. I've attached my log, but when it finished scanning sectors it told me the partitions could not be recovered.
I'm not sure where to go from here...
EDIT on Apr 2: Here is my dmesg | tail when trying to mount this drive:
[ 1486.877553] sd 5:0:0:0: [sdc] Mode Sense: 00 38 00 00
[ 1486.877565] sd 5:0:0:0: [sdc] Assuming drive cache: write through
[ 1486.879790] sd 5:0:0:0: [sdc] Assuming drive cache: write through
[ 1486.880028] sdc: unknown partition table
[ 1486.892570] sd 5:0:0:0: [sdc] Assuming drive cache: write through
[ 1486.892806] sd 5:0:0:0: [sdc] Attached SCSI disk
[ 1538.422662] SGI XFS with ACLs, security attributes, realtime, large block/inode numbers, no debug enabled
[ 1538.427689] SGI XFS Quota Management subsystem
[ 1538.429461] XFS: bad magic number
[ 1538.429471] XFS: SB validate failed
EDIT: Apparently I can't upload log files here... So here's a big dump! You'll also see at the end that I killed the program because it seemed to be trying to make me write an HFS+ partition to the drive, and i didn't know if that would be a bad idea or not.
Wed Mar 28 10:45:44 2012
Command line: TestDisk
TestDisk 6.11, Data Recovery Utility, April 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 2.6.32-5-amd64 (#1 SMP Thu Mar 22 17:26:33 UTC 2012)
Compiler: GCC 4.4 - Sep 5 2010 16:13:36
ext2fs lib: 1.41.12, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 488397168 sectors
/dev/sda: user_max 488397168 sectors
/dev/sda: native_max 488397168 sectors
/dev/sda: dco 488397168 sectors
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - ATA ST9250315AS
Disk /dev/sdb - 7969 MB / 7600 MiB - CHS 1020 246 62, sector size=512 - Multiple Card Reader
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10 EARS-00Y5B1
Partition table type (auto): Intel
Disk /dev/sdc - 1000 GB / 931 GiB - WDC WD10 EARS-00Y5B1
Partition table type: None
Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:
P Unknown 0 0 1 121601 80 63 1953525168
search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Unknown XFS version 0
XFS Marker at 22405/210/41
recover_xfs
XFS 4 22405 210 41 4292826805 248 41 9659776198511754 [--ç㦠FNE:Ã]
XFS 6.2+ - bitmap version, 4945805 TB / 4498183 TiB
This partition ends after the disk limits. (start=359949595, size=9659776198511754, end=9659776558461349, disk end=1953525168)
Unknown XFS version 0
XFS Marker at 34789/164/11
recover_xfs
XFS 4 34789 164 11 4292839189 202 11 9659776198511754 [--ç㦠FNE:Ã]
XFS 6.2+ - bitmap version, 4945805 TB / 4498183 TiB
This partition ends after the disk limits. (start=558895627, size=9659776198511754, end=9659776757407381, disk end=1953525168)
check_FAT: Bad jump in FAT partition
SYSV4 Marker at 65244/36/15
recover_sysv4
SysV 4 65244 36 15 223351 34 5 2539988820 [Å2.]
SysV4, 1300 GB / 1211 GiB
This partition ends after the disk limits. (start=1048147142, size=2539988820, end=3588135961, disk end=1953525168)
HFS+ magic value at 121599/170/24
part_size 9396
HFS+ 121599 170 24 121600 64 32 9396
HFS+, 4810 KB / 4698 KiB
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 4945805 TB / 4498184 TiB)
The following partitions can't be recovered:
XFS 4 22405 210 41 4292826805 248 41 9659776198511754 [--ç㦠FNE:Ã]
XFS 6.2+ - bitmap version, 4945805 TB / 4498183 TiB
XFS 4 34789 164 11 4292839189 202 11 9659776198511754 [--ç㦠FNE:Ã]
XFS 6.2+ - bitmap version, 4945805 TB / 4498183 TiB
SysV 4 65244 36 15 223351 34 5 2539988820 [Å2.]
SysV4, 1300 GB / 1211 GiB
Results
P HFS+ 121599 170 24 121600 64 32 9396
HFS+, 4810 KB / 4698 KiB
Change partition type:
P HFS+ 121599 170 24 121600 64 32 9396
HFS+, 4810 KB / 4698 KiB
SIGINT detected! TestDisk has been killed.