Re: [sleuthkit-users] EXT2 superblock

[Linux T. <lin...@ya...>]

> Testdisk didn't find the partitions either. I'm
> thinking this disk
> might have physical damage.


No Lisa, it most likely does not.  See more notes
below for more.


> I copied the superblock data using dd
> 
> # dd count=1 bs=4k if/dev/hda of=/dev/sda

Ouch.  That was bad.  Should have been bs=512 count=1
since boot code and partition table within that 512. 
you went way beyond that with your command above.

Then twice ouchies because you took an entirely
different hard drive, geometry and probably partitions
layout and wrote that to the one giving errors.  So
now you have bad geo and bad partition table.  It's
getting worse, Lisa, no better!  

Your data may be intact further down the drive. 
Depending upon type and size.  Problem we see now, how
to get to it easily?  You find file(s) inode(s) you
get pointers to data blocks, but that would be first
step for me now.  Quiting phunking up the partition
table stuff and looking for your data and grabbing it.


Had you not done 4k that would be one thing.  You
could have kept searching for good superblock.  gpart
may have helped you early on too Ms Muir.

And lastly, 'mke2fs' might have assisted.  The 'S'
flag would write superblock info again.  You could
have got block size of filesystem from dumpe2fs, but
probably have decent knowledge based on size. 
Anything over couple GB default to 4096.  Nice thing
here is only superblock is redone, your inode table
won't be changed.  

This interesting.  I iwsh you hadn't done 4k dd :(

Cuz most certinaly you destroyed inode table (and
inode bitmaps) :(

-lt


		
__________________________________
Do you Yahoo!?
Yahoo! Mail - 50x more storage than other providers!
http://promotions.yahoo.com/new_mail