Page 5 of 6 FirstFirst ... 3456 LastLast
Results 41 to 50 of 59

Thread: Partition table messed up - hundreds of "ghost" partitions

  1. #41
    Join Date
    Jul 2007
    Beans
    142

    Re: Partition table messed up - hundreds of "ghost" partitions

    Probably stupid question: at this stage, is it better to work on the original or on the clone? I'd say either is ok, but I thought I'd ask first!

    Cristian

  2. #42
    Join Date
    Oct 2009
    Beans
    2,199
    Distro
    Ubuntu 10.10 Maverick Meerkat

    Re: Partition table messed up - hundreds of "ghost" partitions

    Quote Originally Posted by Quaxo76 View Post
    Probably stupid question: at this stage, is it better to work on the original or on the clone? I'd say either is ok, but I thought I'd ask first!

    Cristian
    No right answer. I suppose it may be better to fix the original so that you can then back it up to the new drive.
    ASRock P67 Extreme6, Intel i5 2500K, 8GB RAM, nVidia 6600GT, 4x1TB RAID1+0

  3. #43
    Join Date
    Oct 2009
    Beans
    2,199
    Distro
    Ubuntu 10.10 Maverick Meerkat

    Re: Partition table messed up - hundreds of "ghost" partitions

    I should probably have said to use sudo e2fsck -nf /dev/sdaX so as not to ask you whether to fix anything. You don't want to fix anything at this stage because it is still not certain that the superblock found is the correct one.

    If may be necessary to restore the original start addresses for sda7 & sda8. The superblocks start 1024 bytes or 2 sectors from the partition start. The contents at the original locations can be seen using:

    sudo dd if=/dev/sda bs=512 count=4 skip=276817920 | hexdump -C (for sda7)

    sudo dd if=/dev/sda bs=512 count=4 skip=308144128 | hexdump -C (for sda8 )

    A ext superblock looks like this (starts at 400H):

    Code:
    00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
    *
    00000400  10 07 07 00 00 18 1c 00  99 67 01 00 3c 17 1b 00  |.........g..<...|
    00000410  05 07 07 00 00 00 00 00  02 00 00 00 02 00 00 00  |................|
    00000420  00 80 00 00 00 80 00 00  90 1f 00 00 00 00 00 00  |................|
    00000430  03 e3 80 4e 00 00 16 00  53 ef 01 00 01 00 00 00  |...N....S.......|
    00000440  02 e3 80 4e 00 4e ed 00  00 00 00 00 01 00 00 00  |...N.N..........|
    00000450  00 00 00 00 0b 00 00 00  00 01 00 00 3c 00 00 00  |............<...|
    00000460  42 02 00 00 7b 00 00 00  c5 4c 4a 29 86 0c 47 d6  |B...{....LJ)..G.|
    00000470  a3 46 07 66 80 dc 5d c8  74 65 73 74 00 00 00 00  |.F.f..].test....|
    00000480  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
    *
    000004c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 c1 01  |................|
    000004d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
    000004e0  08 00 00 00 00 00 00 00  00 00 00 00 da f8 3a 4d  |..............:M|
    000004f0  5b 59 41 0f bf 14 82 80  11 e8 6a 86 01 01 00 00  |[YA.......j.....|
    00000500  00 00 00 00 00 00 00 00  02 e3 80 4e 0a f3 02 00  |...........N....|
    00000510  04 00 00 00 00 00 00 00  00 00 00 00 ff 7f 00 00  |................|
    00000520  00 80 08 00 ff 7f 00 00  01 00 00 00 ff ff 08 00  |................|
    00000530  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
    00000540  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 08  |................|
    00000550  00 00 00 00 00 00 00 00  00 00 00 00 1c 00 1c 00  |................|
    00000560  01 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
    00000570  00 00 00 00 04 00 00 00  56 08 02 00 00 00 00 00  |........V.......|
    00000580  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
    ASRock P67 Extreme6, Intel i5 2500K, 8GB RAM, nVidia 6600GT, 4x1TB RAID1+0

  4. #44
    Join Date
    Jul 2007
    Beans
    142

    Re: Partition table messed up - hundreds of "ghost" partitions

    The e2fsck command:
    - For sda7, says
    Code:
    Superblock has an invalid journal (inode 8).
    Clear? no
    - For sda8 and sda11 gives a huge amount of text (123KB for sda8 and 1.2MB for sda11). Of course I can't quote it here, but I attached them to this post.

    The hexdump: it sort of seems to make sense, the "53 ef" pair of bytes are there. Dumps attached as well.

    Now the question I'm scared to ask: sda7 and sda8 have some important data (especially 8) but probably the most important is in sda11. Given that I don't have the original start sector (the output from the first fdisk -lu doesn't include a valid sda11), is there no way to find the correct start? Is there a "magic string of bytes" we could search for around the place where we expect it to be?

    Cristian
    Attached Files Attached Files

  5. #45
    Join Date
    Oct 2009
    Beans
    2,199
    Distro
    Ubuntu 10.10 Maverick Meerkat

    Re: Partition table messed up - hundreds of "ghost" partitions

    It looks safe to restore the start and end sectors now using the same method as you used for the extended partition:
    sda7: start=276817920, size=31324160
    sda8: start=308144128, size=61462528
    Re-run the fs check afterwards.

    Not sure about sda11. I think your idea of searching within a likely sector range will bear fruit. I need to sleep on it.
    ASRock P67 Extreme6, Intel i5 2500K, 8GB RAM, nVidia 6600GT, 4x1TB RAID1+0

  6. #46
    Join Date
    Jul 2007
    Beans
    142

    Re: Partition table messed up - hundreds of "ghost" partitions

    OK, I corrected the partition table (while I was at it, I also corrected sda1, which had been "shrunk" by testdisk for no appartent reason).
    After reboot, sda7 and 8 (and 1) appear to mount fine, and I seem to find the data there.

    Running fsck -f /dev/sda7 says the filesystem is clean:
    Code:
    Pass 1: Checking inodes, blocks, and sizes
    Pass 2: Checking directory structure
    Pass 3: Checking directory connectivity
    Pass 4: Checking reference counts
    Pass 5: Checking group summary information
    /dev/sda7: 218195/979200 files (2.8% non-contiguous), 1218872/3915520 blocks
    while checking sda8 gives lots of errors. But I still seem to be able to access the files...

    Now, should I backup the file somewhere or let fsck fix it?

    And for sda11: I suppose it should start somewhere after the end of sda10. Is there a "hex disk editor" program that I can use to check the hex data on the disk, to look for the actual start of the partition?
    Also: if I manage to find the partition start sector, how do I calculate the partition end? GParted seems to know the approximate size, should I use that data?

    Thanks,
    Cristian

  7. #47
    Join Date
    Oct 2009
    Beans
    2,199
    Distro
    Ubuntu 10.10 Maverick Meerkat

    Re: Partition table messed up - hundreds of "ghost" partitions

    Quote Originally Posted by Quaxo76 View Post
    OK, I corrected the partition table (while I was at it, I also corrected sda1, which had been "shrunk" by testdisk for no appartent reason).
    After reboot, sda7 and 8 (and 1) appear to mount fine, and I seem to find the data there.

    while checking sda8 gives lots of errors. But I still seem to be able to access the files...

    Now, should I backup the file somewhere or let fsck fix it?
    Good. With sda8 I suppose it depends on the errors. I reckon you should have fsck fix it to avoid any file corruption. You can always start again using the backup if necessary.

    And for sda11: I suppose it should start somewhere after the end of sda10. Is there a "hex disk editor" program that I can use to check the hex data on the disk, to look for the actual start of the partition?
    One approach would be to dd a large area into a text file and then search it for hex strings like the magic number. I'll suggest something in a moment.
    Also: if I manage to find the partition start sector, how do I calculate the partition end? GParted seems to know the approximate size, should I use that data?
    It should be possible to get another estimate from the superblock too - it will state the fs size in blocks.
    Back soon.
    ASRock P67 Extreme6, Intel i5 2500K, 8GB RAM, nVidia 6600GT, 4x1TB RAID1+0

  8. #48
    Join Date
    Jul 2007
    Beans
    142

    Re: Partition table messed up - hundreds of "ghost" partitions

    Status update:
    We're starting to see the light!
    To recap what I've done:
    - For sda1, sda7, sda8 I restored the start sector and size using what was there before testisk messed it up;
    - For sda11, I think I understood what happened. Testdisk had found (and restored) a partition called "Appoggio", which in Italian means something like "Temporary". It must have been an old partition, deleted long ago; looks like Testdisk thought it was something to rescue, but it was not. I used a disk editor (called iBored, very slow but it worked) and started to search after that sector, and indeed after a few sectors I found the start of another partition, called "Dati" - which makes sense because that's the name of the folder where I had it mounted.
    So I set the start sector of sda11 to two sectors before where I found the two "magic bytes", and the end sector to a few sectors before the start of sda12.
    Saved, rebooted and... looks like sda11 is back! It also tests clean with fsck. The end sector is probably off, but if it is, it's now bigger than the filesystem, and not smaller - as I made it as big as it could be. How can I use the superblock to find the right size?

    Anyway... The files seem to be readable on all partitions - I didn't check them all of course, but at first sight they are. Can I try booting the old system to see if it boots?
    I attached the output of fsck on /dev/sda8, and it's a really big output. Should I try copying the files somewhere, in case fsck breaks it? Or is it safe enough?

    Anyway, lesson #1 learned: testdisk is dangerous and doesn't know what it does, and it breaks also perfectly good partitions.

    Cristian
    Attached Files Attached Files

  9. #49
    Join Date
    Oct 2009
    Beans
    2,199
    Distro
    Ubuntu 10.10 Maverick Meerkat

    Re: Partition table messed up - hundreds of "ghost" partitions

    The original end sector of sda10 is 542049164. Normally, there has to be a gap of at least 1 sector for the EBR so sda11 cannot start before 542049166. Testdisk made it start at 165.

    First dump 165 and let's see if it is an EBR; if so it will give the start sector for sda11 relative to the original sector of the first EBR. The EBR sector will end with "55 aa".

    sudo dd if=/dev/sda bs=512 count=1 skip=542049165 | hexdump -C

    You can dump sectors and search for the "Appogio" sequence:
    sudo dd if=/dev/sda bs=512 count=10000 skip=542049165 | hexdump -C | grep -e "Appog"
    ASRock P67 Extreme6, Intel i5 2500K, 8GB RAM, nVidia 6600GT, 4x1TB RAID1+0

  10. #50
    Join Date
    Oct 2009
    Beans
    2,199
    Distro
    Ubuntu 10.10 Maverick Meerkat

    Re: Partition table messed up - hundreds of "ghost" partitions

    I missed your post! Sounds like you are really getting the hang of this.
    Quote Originally Posted by Quaxo76 View Post
    Status update:
    We're starting to see the light!
    To recap what I've done:
    - For sda1, sda7, sda8 I restored the start sector and size using what was there before testisk messed it up;
    - For sda11, I think I understood what happened. Testdisk had found (and restored) a partition called "Appoggio", which in Italian means something like "Temporary". It must have been an old partition, deleted long ago; looks like Testdisk thought it was something to rescue, but it was not. I used a disk editor (called iBored, very slow but it worked) and started to search after that sector, and indeed after a few sectors I found the start of another partition, called "Dati" - which makes sense because that's the name of the folder where I had it mounted.
    So I set the start sector of sda11 to two sectors before where I found the two "magic bytes", and the end sector to a few sectors before the start of sda12.
    Saved, rebooted and... looks like sda11 is back! It also tests clean with fsck. The end sector is probably off, but if it is, it's now bigger than the filesystem, and not smaller - as I made it as big as it could be. How can I use the superblock to find the right size?
    If fsck -f is clean then don't touch it!

    Anyway... The files seem to be readable on all partitions - I didn't check them all of course, but at first sight they are. Can I try booting the old system to see if it boots?
    I attached the output of fsck on /dev/sda8, and it's a really big output. Should I try copying the files somewhere, in case fsck breaks it? Or is it safe enough?
    Wait while I look.

    Anyway, lesson #1 learned: testdisk is dangerous and doesn't know what it does, and it breaks also perfectly good partitions.
    Lesson learned? This is why I recommended manually finding the EBRs and fixing them.
    ASRock P67 Extreme6, Intel i5 2500K, 8GB RAM, nVidia 6600GT, 4x1TB RAID1+0

Page 5 of 6 FirstFirst ... 3456 LastLast

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •