Two weeks ago, I discovered my harddrive was dead. The bios won't even detect it :( I tried to restore my backups onto another computer from a couple of tar.gz files on a USB drive only to find errors when gunzipping them. :(. I can get about 1/3 files off.) However, I notice that somehow I made an image of the whole harddrive (12 partitions) and it stored on my USB drive too as /kubuntu/dev/hda I tried doing the mount /media/disk/kubuntu/dev/hda -o loop /mnt/hda (after making /mnt/hda first) but it (not unsuprisingly) can't figure out the partitions.of find a file system. There were all ext2 or ext3 from memory Is there a way I can mount this image? Do I need the partition tables? would ubuntu dapper have made a copy and put them anywhere? I have /etc and /var from the disk too. This /dev/hda is about 25G so I am wondering if I have a suitable image. And maybe I can recoved the photos etc. Thanks for any thoughts or suggestions. Cheers Chris
On 24/10/2007, Chris O'Halloran <cmoman(a)gmail.com> wrote:
However, I notice that somehow I made an image of the whole harddrive (12 partitions) and it stored on my USB drive too as /kubuntu/dev/hda
The following link appears to have the answer... http://krnjevic.com/wp/?p=33 -- See my blog at http://snap-happy3216.blogspot.com
On Wednesday 24 October 2007 16:13:11 Glenn Enright wrote:
On 24/10/2007, Chris O'Halloran <cmoman(a)gmail.com> wrote:
However, I notice that somehow I made an image of the whole harddrive (12 partitions) and it stored on my USB drive too as /kubuntu/dev/hda
The following link appears to have the answer...
Thanks very much for the feedback. It seems I might be pretty close
From the website it talks about using the file, fdisk and mount commands.
File returns some information but sfdisk -l / returns <quote> cmoman(a)neptune:/mnt$ sfdisk -l /media/disk/kubuntu/kubuntu/dev/hda Disk /media/disk/kubuntu/kubuntu/dev/hda: cannot get geometry Disk /media/disk/kubuntu/kubuntu/dev/hda: 0 cylinders, 0 heads, 0 sectors/track read: Inappropriate ioctl for device sfdisk: read error on /media/disk/kubuntu/kubuntu/dev/hda - cannot read sector 59922450 Warning: The partition table looks like it was made for C/H/S=*/255/63 (instead of 0/0/0). For this listing I'll assume that geometry. Units = cylinders of 8225280 bytes, blocks of 1024 bytes, counting from 0 Device Boot Start End #cyls #blocks Id System /media/disk/kubuntu/kubuntu/dev/hda1 0+ 63 64- 514048+ 82 Linux swap / Solaris /media/disk/kubuntu/kubuntu/dev/hda2 64 9727 9664 77626080 f W95 Ext'd (LBA) /media/disk/kubuntu/kubuntu/dev/hda3 0 - 0 0 0 Empty /media/disk/kubuntu/kubuntu/dev/hda4 0 - 0 0 0 Empty /media/disk/kubuntu/kubuntu/dev/hda5 64+ 67 4- 32098+ 83 Linux /media/disk/kubuntu/kubuntu/dev/hda6 68+ 1373 1306- 10490413+ 83 Linux /media/disk/kubuntu/kubuntu/dev/hda7 1374+ 1896 523- 4200966 83 Linux /media/disk/kubuntu/kubuntu/dev/hda8 * 1897+ 1900 4- 32098+ 83 Linux /media/disk/kubuntu/kubuntu/dev/hda9 1901+ 3206 1306- 10490413+ 83 Linux /media/disk/kubuntu/kubuntu/dev/hda10 3207+ 3729 523- 4200966 83 Linux </quote> Now provided the disk isn't entirely corrupt I can supposedly calculate the offset and use the following command where 559319040 is the offset in bytes. cmoman(a)neptune:/mnt$ sudo mount -t ext2 -o loop,offset=559319040 /media/disk/kubuntu/kubuntu/dev/hda partition1/ the following error is returned. mount: wrong fs type, bad option, bad superblock on /dev/loop0, missing codepage or other error In some cases useful info is found in syslog - try dmesg | tail or so 8225280*68=559319040 8225280 being the bytes per cylinder and 68 being the number of cylinders to the mount point of /hda6 And trying 8225280*(68+64)=1085736960 doesn't seem to work either (I am not sure how the extended partition works). Obviously I can't really brute force this so I am trying to work out the number of bytes I need to put in the offset variable to start the mount point on the image. Thanks again for your ideas. Cheers Chris
Now provided the disk isn't entirely corrupt I can supposedly calculate the offset and use the following command where 559319040 is the offset in bytes.
cmoman(a)neptune:/mnt$ sudo mount -t ext2 -o loop,offset=559319040 /media/disk/kubuntu/kubuntu/dev/hda partition1/
the following error is returned.
mount: wrong fs type, bad option, bad superblock on /dev/loop0, missing codepage or other error In some cases useful info is found in syslog - try dmesg | tail or so
What's in dmesg? There are other tools which take some of the guesswork out of this: kpartx, lomount, and losetup, all might make it a bit easier to get these partitions mounted. kpartx -a /path/to/image/file should setup some devicemaps for the partitions, which should let you mount them directly. Otherwise, you could try lomount -t fstype -diskimage /path/to/image/file -partition 5 /mnt
8225280*68=559319040
8225280 being the bytes per cylinder and 68 being the number of cylinders to the mount point of /hda6
And trying 8225280*(68+64)=1085736960 doesn't seem to work either (I am not sure how the extended partition works).
I've done this in the past, but by referring to the sector allocation rather than cylinders. Sectors on disk are 512 bytes
If all else fails, BACK-UP what you have, or copy it to a temp location to work on it: Get a program called Foremost - apt-get should get it for most distros - it basically goes through a drive?/file?/partition? and, similar to Anti-Virus programs, uses a file type 'signature' to try and guess where a particular file starts and finishes - more info here: http://pcburn.com/data_recovery-Foremost.php HTH. Elroy. Chris O'Halloran wrote:
Two weeks ago, I discovered my harddrive was dead. The bios won't even detect it :(
However, I notice that somehow I made an image of the whole harddrive (12 partitions) and it stored on my USB drive too as /kubuntu/dev/hda
Thanks for any thoughts or suggestions.
Cheers
Chris
Get a program called Foremost - apt-get should get it for most distros - it basically goes through a drive?/file?/partition? and, similar to Anti-Virus programs, uses a file type 'signature' to try and guess where a particular file starts and finishes - more info here:
There's also gpart (not gparted!) which guesses the partition table based on whatever filesystem data it can recognise. I notice both these programs are in the ubuntu repos too, which is rather convenient!
participants (5)
-
Bruce Kingsbury -
Chris O'Halloran -
Daniel Lawson -
elroy -
Glenn Enright