If you happen to be near Coventry in the UK on Tuesday evening, the local Linux User Group is having a data recovery specialist/police forensics consultant do a presentation on recovery techniques, using Linux.

Email me off list for details.

Regards,

Ian





From: William Shu <[log in to unmask]>
To: [log in to unmask]
Cc: [log in to unmask]
Sent: Saturday, 17 October, 2009 21:24:21
Subject: How can I access a possibly corrupted hard drive

Hi,
I suddenly could not boot from my Western Digital hard drive connected through a SATA PCI card. I was told the drive is 'seen' in the hardware and that my problem is in the operating system problem (software), which the tecnician cannot handle.

booting with a scientific linux 5.3 livedvd, I have tried to use fdisk to list and fsck to correct the errors but to no avail. tried gparted which seems to suggest disk is not formatted, and testdisk ends up with IO read errors. The drive was formatted for logical volume management (LVM), but it does not even appear when I click System->Adminstration->Logical Volume Management. from the desktop

Is there anyone who can suggest what could be wrong, what I could do to correct this problem, or at least get back my data?

Details of outputs from commands below.

Many thanks,

William.

------------------------[ fdisk and fsck outputs ]-------------------------

[root@slinux sluser]# uname -a
Linux slinux 2.6.18-128.1.1.el5 #1 SMP Tue Feb 10 11:42:49 EST 2009 i686 i686 i386 GNU/Linux
[root@slinux sluser]#
[root@slinux sluser]# /sbin/fdisk -l
 
Disk /dev/hda: 81.9 GB, 81964302336 bytes
255 heads, 63 sectors/track, 9964 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/hda1   *           1         637     5116671    b  W95 FAT32
/dev/hda2             638        9963    74911095    f  W95 Ext'd (LBA)
/dev/hda5             651        1415     6144831    b  W95 FAT32
/dev/hda6            9243        9499     2064321    c  W95 FAT32 (LBA)
/dev/hda7             638         650      104359+  83  Linux
/dev/hda8            1416        9242    62870346   8e  Linux LVM

Unable to read /dev/sda
[root@slinux sluser]# /sbin/fsck -s /dev/sda{2,3,5,6,7} -ap
fsck 1.39 (29-May-2006)
fsck.ext2: No such file or directory while trying to open /dev/sda2
/dev/sda2:
The superblock could not be read or does not describe a correct ext2
filesystem.  If the device is valid and it really contains an ext2
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
    e2fsck -b 8193 <device>

<snip>


-----------------[ Content of backup log testdisk backup.log ]-------------
#1255771918 Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
 1 : start=       63, size=123780762, Id=07, P
 2 : start=123780825, size=  5012280, Id=83, *
 3 : start=128793105, size=496344240, Id=05, E


-----------------[ Content of logfile of testdisk testdisk.log ]-------------

Sat Oct 17 05:28:14 2009
Command line: TestDisk /log /dev/sda

Using locale 'en_US.UTF-8'.
TestDisk 6.10, Data Recovery Utility, July 2008
Christophe GRENIER <[log in to unmask]>
http://www.cgsecurity.org
OS: Linux, kernel 2.6.18-128.1.1.el5 (#1 SMP Tue Feb 10 11:42:49 EST 2009)
Compiler: GCC 4.1 - Jul 26 2008 03:55:42
ext2fs lib: 1.39, ntfs lib: 9:0:0, reiserfs lib: 0.3.0.4, ewf lib: none
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - ATA WDC WD3200AAKS-0

Partition table type (auto): Intel
Disk /dev/sda - 320 GB / 298 GiB - ATA WDC WD3200AAKS-0
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
get_geometry_from_list_part_aux head=255 nbr=6
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=6
 1 P HPFS - NTFS              0   1  1  7704 254 63  123780762
     NTFS, 63 GB / 59 GiB
 2 * Linux                 7705   0  1  8016 254 63    5012280 [/boot1]
     EXT3 Large file Sparse superblock Recover, 2566 MB / 2447 MiB
 3 E extended              8017   0  1 38912 254 63  496344240

Analyse Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Geometry from i386 MBR: head=255 sector=63
get_geometry_from_list_part_aux head=255 nbr=6
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=6
Current partition structure:
 1 P HPFS - NTFS              0   1  1  7704 254 63  123780762
 2 * Linux                 7705   0  1  8016 254 63    5012280 [/boot1]
 3 E extended              8017   0  1 38912 254 63  496344240
Backup partition structure
Ask the user for vista mode
Allow partial last cylinder : No
search_vista_part: 0

search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
   D HPFS - NTFS              0   1  1  7704 254 63  123780762
     NTFS, 63 GB / 59 GiB
   D Linux                 7705   0  1  8016 254 63    5012280 [/boot1]
     EXT3 Large file Sparse superblock Recover, 2566 MB / 2447 MiB
file_read(4,16,buffer,128793121(8017/0/17)) read err: Input/output error
file_read(4,1,buffer,128793121(8017/0/17)) read err: Input/output error
file_read(4,1,buffer,128793122(8017/0/18)) read err: Input/output error
file_read(4,1,buffer,128793123(8017/0/19)) read err: Input/output error
file_read(4,16,buffer,128793168(8017/1/1)) read err: Input/output error
file_read(4,1,buffer,128793168(8017/1/1)) read err: Input/output error
file_read(4,1,buffer,128793169(8017/1/2)) read err: Input/output error
file_read(4,1,buffer,128793170(8017/1/3)) read err: Input/output error
file_read(4,16,buffer,128793184(8017/1/17)) read err: Input/output error
file_read(4,1,buffer,128793184(8017/1/17)) read err: Input/output error
file_read(4,1,buffer,128793185(8017/1/18)) read err: Input/output error
<snip>


__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com