Data listable and copiable / bad superblocks

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
pouzzler
Posts: 3
Joined: 25 Jan 2016, 14:27

Data listable and copiable / bad superblocks

#1 Post by pouzzler »

Hello, a power cut has made my nas unbootable.
The hard drive is a recent (bought about six months ago) 3TB Toshiba DT01ABA300.
The nas was installed with Ubuntu 14.04, using no special options at all, especially not for formatting and partitionning.

Therefore, there are but three partitions : one which I suppose is the boot partition, a main partition taking almost all the drive, and a small swap.

Testdisk's [ Analyse ] finds a "MS Data" partition, which is the first thing I don't understand; does it mean "Microsoft Data"? Why would Ubuntu format anything in a Microsoft format?

If I go on with this analysis, I can list all the partition's folders, and have tried copying over some files to see if anything was broken, and no tested file was.

Before that, I tried [ Advanced ] on my own, where I chose MBR, then ext4. I could list everything without problems there either. That is my second question - is the correct type "MBR", or "MS Data"? Why does it list everything correctly when I assumed two different things, and it must be one or the other, not both, musn't it?

Lastly, and most importantly, even though all the data is there, clearly listable and copiable by name, the drive doesn't mount, and trying

Code: Select all

for i in $(grep e2fsck testdisk.log | uniq | cut -d " " -f4); do sudo e2fsck -b $i -B 4096 /dev/sdc1; done
which I found on this forum, gives me this for each backup superblock :
e2fsck 1.42.9 (4-Feb-2014)
e2fsck: Invalid argument while trying to open /dev/sdc1

The superblock could not be read or does not describe a valid ext2/ext3/ext4
filesystem. If the device is valid and it really contains an ext2/ext3/ext4
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
e2fsck -b 8193 <device>
or
e2fsck -b 32768 <device>
Since the data is there, listable and identifiable by name, it is more than probable that the partition can be saved, and before I do something stupid that would force me to use photorec, I'd appreciate it very much if someone who has saved more drives than me in their time could point me in the right direction.

Thanks for reading,
Sébastien

PS : another drive, got the click of death on the same electrical incident. Is it worth trying it with testdisk, or will that just be a waste of time?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Data listable and copiable / bad superblocks

#2 Post by cgrenier »

Linux and Windows both uses the same GPT id to describe a data partition.
What is the result of

Code: Select all

fsck.ext4 /dev/sdc1

pouzzler
Posts: 3
Joined: 25 Jan 2016, 14:27

Re: Data listable and copiable / bad superblocks

#3 Post by pouzzler »

Hello, it is no more sdc1, but sdd1, since I connected another drive.

Here is what fsck.ext4 returns :
seb@deskybuntu:~$ sudo fsck.ext4 /dev/sdd1
e2fsck 1.42.9 (4-Feb-2014)
ext2fs_open2: Bad magic number in super-block
fsck.ext4: Superblock invalid, trying backup blocks...
fsck.ext4: Bad magic number in super-block while trying to open /dev/sdd1

The superblock could not be read or does not describe a valid ext2/ext3/ext4
filesystem. If the device is valid and it really contains an ext2/ext3/ext4
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
e2fsck -b 8193 <device>
or
e2fsck -b 32768 <device>
Here is testdisk's log :
Tue Jan 26 17:58:02 2016
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.13.0-66-generic (#108-Ubuntu SMP Wed Oct 7 15:20:27 UTC 2015) x86_64
Compiler: GCC 4.8
Compilation date: 2013-10-29T01:29:29
ext2fs lib: 1.42.9, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 1000215216 sectors
/dev/sda: user_max 1000215216 sectors
/dev/sda: native_max 1000215216 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size 976773168 sectors
/dev/sdb: user_max 976773168 sectors
/dev/sdb: native_max 976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - Crucial_CT512MX100SSD1, S/N:14340CFDDE46, FW:MU01
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - CT500BX100SSD1, S/N:1524F0087554, FW:MU02
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - SAMSUNG HD204UI, FW:1AQ1
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - TOSHIBA DT01ABA300, FW:MZ6O

Partition table type (auto): EFI GPT
Disk /dev/sdd - 3000 GB / 2794 GiB - TOSHIBA DT01ABA300
Partition table type: EFI GPT

Analyse Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P Unknown 2048 4095 2048
2 P Unknown 4096 5857521663 5857517568
3 P Linux Swap 5857521664 5860532223 3010560

search_part()
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63

recover_EXT2: s_block_group_nr=0/22344, s_mnt_count=10/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 732189696
recover_EXT2: part_size 5857517568
MS Data 4096 5857521663 5857517568
ext4 blocksize=4096 Large file Sparse superblock Recover, 2999 GB / 2793 GiB
Linux Swap 5857521664 5860532207 3010544
SWAP2 version 1, pagesize=4096, 1541 MB / 1469 MiB

Results
P MS Data 4096 5857521663 5857517568
ext4 blocksize=4096 Large file Sparse superblock Recover, 2999 GB / 2793 GiB
P Linux Swap 5857521664 5860532207 3010544
SWAP2 version 1, pagesize=4096, 1541 MB / 1469 MiB

interface_write()
1 P MS Data 4096 5857521663 5857517568
2 P Linux Swap 5857521664 5860532207 3010544
simulate write!

TestDisk exited normally.
A testdisk deeper search does this for hours :
MS Data 4096 5857521663 5857517568
MS Data 4094 5857521661 5857517568
with always the same two values.

Thanks for your time,
Sébastien

pouzzler
Posts: 3
Joined: 25 Jan 2016, 14:27

Re: Data listable and copiable / bad superblocks

#4 Post by pouzzler »

Hello,

I bought a hard drive in order to save the data by simple copying. However if it were to be confirmed that choosing to write the detected partition scheme to disk would work, I would have learnt something new, which is even more interesting.

Best regards and thanks for reading this.
Sébastien

Locked