Return to BSD News archive
Path: euryale.cc.adfa.oz.au!newshost.anu.edu.au!harbinger.cc.monash.edu.au!munnari.OZ.AU!news.ecn.uoknor.edu!news.ysu.edu!usenet.ins.cwru.edu!gatech!news.mathworks.com!fu-berlin.de!irz401!orion.sax.de!uriah.heep!news
From: j@uriah.heep.sax.de (J Wunsch)
Newsgroups: comp.unix.bsd.freebsd.misc
Subject: Re: file system HELP HELP HELP
Date: 15 Jul 1996 11:54:37 GMT
Organization: Private BSD site, Dresden
Lines: 68
Message-ID: <4sdbht$fne@uriah.heep.sax.de>
References: <31E6C1F4.6FB1@ucdavis.edu> <4s86ok$n33@uriah.heep.sax.de>
<4s8o0d$3gb@news.cs.tu-berlin.de> <31E9C455.3CC4@ucdavis.edu>
Reply-To: joerg_wunsch@uriah.heep.sax.de (Joerg Wunsch)
NNTP-Posting-Host: localhost.heep.sax.de
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-Newsreader: knews 0.9.6
X-Phone: +49-351-2012 669
X-PGP-Fingerprint: DC 47 E6 E4 FF A6 E9 8F 93 21 E0 7D F9 12 D6 4E
Michael White <mdwhite@ucdavis.edu> wrote:
> Like I said previously, I was able to use the install disk to
> look at the drive and it looks like there are no partitions anymore.
> Just one big empty disk.
Partitions? Or slices?
You don't necessarily need fdisk slices... ah, yep, i re-read the
thread. You used to have two slices on it (curious: why? it doesn't
buy you very much). Well, your only chances are that you are able to
remember all the hairy details. If you know how the disk was
partitioned (by block numbers, or if you did it with sysinstall,
perhaps by megabytes), it should be possible to put the fdisk table
and perhaps even labels back into place. I once had to do this for a
disk where sector 0 has been trashed by a kernel core dump, and using
the exact same numbers for a sysinstall run yielded the same results
and got the disk back to life.
Of course, you need to be careful to stop _before_ sysinstall would
newfs your partitions.
If you don't know the previous layout, you might still be able to find
it the hard way by searching the disk for the disklabel or file system
magic numbers. The disklabel magic numbers are stored at offset 0x200
and 0x284 from the beginning of the slice:
0000200 57 45 56 82 04 00 00 00 73 74 33 36 35 35 6e 00 WEV.....st3655n.
^^^^^^^^^^^
0000210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000220 00 00 00 00 00 00 00 00 00 02 00 00 55 00 00 00 ............U...
0000230 05 00 00 00 c9 09 00 00 a9 01 00 00 4c 40 10 00 ....É...©...L@..
0000240 00 00 00 00 00 00 00 00 94 11 01 00 00 00 00 00 ................
0000250 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
*
0000280 00 00 00 00 57 45 56 82 dd a7 08 00 00 20 00 00 ....WEV.ݧ... ..
^^^^^^^^^^^
If your disklabels are intact, you should be able to recreate the
fdisk table from the positions of the above magic numbers.
If your disklabels have also been destroyed, you can still get the
chance to search for the UFS magic numbers of the various file
systems. They are stored at offset 0x255c and 0x455c from the
beginning of the partition:
0002550 01 00 00 00 00 00 00 00 00 00 00 00 54 19 01 00 ............T...
^^^^^^^^^^^
0002560 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
*
[...]
0004550 01 00 00 00 00 00 00 00 00 00 00 00 54 19 01 00 ............T...
^^^^^^^^^^^
The magic number at offset 0x455c is from the first alternate
superblock, be careful to *only* match them in the above offsets, or
you will be fooled by the following alternate superblocks!
Naturally, you won't find the start of the swap partition this way,
but it should be determinable by examining f/s size value in the
superblock of the file system just before the swap area.
--
cheers, J"org
joerg_wunsch@uriah.heep.sax.de -- http://www.sax.de/~joerg/ -- NIC: JW11-RIPE
Never trust an operating system you don't have sources for. ;-)