Page 1 of 1

TestDisk sees partition quickly, restores, but damaged FS?

Posted: 24 Aug 2013, 18:40
by maya
Hello!

I have a 4TB HDD which was accidentally formatted as a Linux raid.

Upon using TestDisk, it quickly found the partition I overwrote, and wrote in a new GPT partition table.

However, the filesystem seems to be damaged, or that's what TestDIsk told me when I tried viewing files.

I started to use PhotoRec to see if it could recover anything, and it could, very easily. I don't have any spares to output the rest to.

When I attempted to run e2fsck afterwards, it gave me the usual superblock errors. I tried every alternate it gave, with no avail.

This is my TestDisk log, if it helps any:

Code: Select all

Sat Aug 24 13:17:29 2013
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.8.0-19-generic (#29-Ubuntu SMP Wed Apr 17 18:16:28 UTC 2013) x86_64
Compiler: GCC 4.4
Compilation date: 2013-07-30T14:13:28
ext2fs lib: 1.41.12, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
/dev/sda: LBA, LBA48, DCO support
/dev/sda: size       488397168 sectors
/dev/sda: user_max   488397168 sectors
/dev/sda: dco        488397168 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size       7814037168 sectors
/dev/sdb: user_max   7814037168 sectors
/dev/sdb: native_max 7814037168 sectors
/dev/sdb: dco        7814037168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - VB0250EAVER, S/N:W2AH1KL5, FW:HPG7
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - Hitachi HDS5C4040ALE630, S/N:PL1310LAG0SEXA, FW:MPAOA250

Partition table type (auto): EFI GPT
Disk /dev/sdb - 4000 GB / 3726 GiB - Hitachi HDS5C4040ALE630
Partition table type: EFI GPT

Analyse Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=7814037167 (expected 7814037167)
hdr_lba_start=34
hdr_lba_end=7814037134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Data                     2046 7814035453 7814033408
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 1 P MS Data                     2046 7814035453 7814033408
 1 P MS Data                     2046 7814035453 7814033408

search_part()
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63

recover_EXT2: s_block_group_nr=0/18, s_mnt_count=3/36, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 622544
recover_EXT2: part_size 4980352
     MS Data                      256    4980607    4980352 [1.41.10-2668]
     ext4 blocksize=4096 Large file Sparse superblock, 2549 MB / 2431 MiB

Raid magic value at 310/7/18
Raid apparent size: 2180925952 sectors
Raid chunk size: 0 bytes
md0 md 0.90.0 B.Endian Raid 1: devices 0(8,1) 1(8,17)*
     Linux Raid                   256    4980735    4980480 [md0]
     md 0.90.0 B.Endian Raid 1: devices 0(8,1) 1(8,17)*, 2550 MB / 2431 MiB
     Linux Swap               4980736    9174895    4194160
     SWAP2 version 1, pagesize=4096, 2147 MB / 2047 MiB

Raid magic value at 571/28/34
Raid apparent size: 2180922880 sectors
Raid chunk size: 0 bytes
md1 md 0.90.0 B.Endian Raid 1: devices 0(8,2) 1(8,18)*
     Linux Raid               4980736    9175039    4194304 [md1]
     md 0.90.0 B.Endian Raid 1: devices 0(8,2) 1(8,18)*, 2147 MB / 2048 MiB

block_group_nr 49

recover_EXT2: "e2fsck -b 1605632 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=49/29808, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 976754176
recover_EXT2: part_size 7814033408
     MS Data                     2046 7814035453 7814033408 [Music]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 4000 GB / 3726 GiB

Results
     MS Data                      256    4980607    4980352 [1.41.10-2668]
     ext4 blocksize=4096 Large file Sparse superblock, 2549 MB / 2431 MiB
     Linux Raid                   256    4980735    4980480 [md0]
     md 0.90.0 B.Endian Raid 1: devices 0(8,1) 1(8,17)*, 2550 MB / 2431 MiB
     MS Data                     2046 7814035453 7814033408 [Music]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 4000 GB / 3726 GiB
     Linux Swap               4980736    9174895    4194160
     SWAP2 version 1, pagesize=4096, 2147 MB / 2047 MiB
     Linux Raid               4980736    9175039    4194304 [md1]
     md 0.90.0 B.Endian Raid 1: devices 0(8,2) 1(8,18)*, 2147 MB / 2048 MiB

     MS Data                     2046 7814035453 7814033408 [Music]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 4000 GB / 3726 GiB
Can't open filesystem. Filesystem seems damaged.

     MS Data                     2046 7814035453 7814033408 [Music]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 4000 GB / 3726 GiB
Can't open filesystem. Filesystem seems damaged.

     MS Data                      256    4980607    4980352 [1.41.10-2668]
     ext4 blocksize=4096 Large file Sparse superblock, 2549 MB / 2431 MiB
Can't open filesystem. Filesystem seems damaged.

     Linux Raid                   256    4980735    4980480 [md0]
     md 0.90.0 B.Endian Raid 1: devices 0(8,1) 1(8,17)*, 2550 MB / 2431 MiB
Support for this filesystem hasn't been enable during compilation.

     Linux Raid               4980736    9175039    4194304 [md1]
     md 0.90.0 B.Endian Raid 1: devices 0(8,2) 1(8,18)*, 2147 MB / 2048 MiB
Support for this filesystem hasn't been enable during compilation.

interface_write()
 1 P MS Data                     2046 7814035453 7814033408 [Music]
write!
No extended partition
Need to fix
 1 P MS Data                     2046 7814035453 7814033408 [Music]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 4000 GB / 3726 GiB
You will have to reboot for the change to take effect.

TestDisk exited normally.


Help? :(

Re: TestDisk sees partition quickly, restores, but damaged F

Posted: 25 Aug 2013, 09:53
by cgrenier
Be carefull when you use fsck you need to use the partition device, not the disk device.

Code: Select all

e2fsck -b 1605632 -B 4096 /dev/sdb1

Re: TestDisk sees partition quickly, restores, but damaged F

Posted: 29 Aug 2013, 02:31
by maya
Thank you!

Although that seems to be working, fsck keeps hitting memory allocation issues, and I am forced to start all over again.

I found out one could assign a scratch file via the /etc/e2fsck.conf file, but I'm not sure if that's helping or anything.

Any advice how to get this to not quit during repair?

Thank you again!

Re: TestDisk sees partition quickly, restores, but damaged F

Posted: 06 Sep 2013, 07:56
by cgrenier
No real solution: try to update e2fsprogs package to latest version, boost your computer memory or move the disk to computer with more memory.