Re: OT: fdisk - Data Recovered

2010-10-06 Thread Robert 
On Mon, 4 Oct 2010 11:42:49 -0700
Robert  wrote:

> On Tue, 5 Oct 2010 03:53:09 +1100 (EST)
> Ian Smith  wrote:
> 
> Ian
> 
> I am in the process of dd the entire disk to a 1TB disk but I wanted
> to respond to you. You have given a lot of good advice and
> information and I appreciate it.
> 

To all who responded to my ntfs fiasco, not only do I thank you but the
wife passes along her thanks and makes the point that she didn't need a
second bottle of wine. :-)

The above dd operation finished late last night but I didn't start
working on until this morning.

Using FreeBSD it acted exactly as the other dd attempts did, i.e. I
could mount_ntfs /dev/ad6 and see the same as I did before but ad6s1
failed to mount as ntfs. ad6s1 would mount with no fs specified but
nothing was readable.

I rebooted into Windows XP and to my surprise the computer restarted
right after the desktop rendered. I then booted into safe mode with
command prompt. This booted successfully and then I changed drives
until I found the data I was looking for. The 1tb drive, now showing as
500GB, appeared as drive G:

I ran chkdsk against g: and after finding and clearing several errors
it quit without completing. I tried to boot normal and the computer
rebooted after the desktop rendered again. I then booted into safe mode
and it came up and ran OK. 

I was able to open the drive and see the data I needed. I inserted a
thumb drive and copied the data over. 

I'm her hero again and we will have the second bottle tonight. :-)

Thanks again to everyone for all the great help.

Robert
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re: OT: fdisk

2010-10-05 Thread Robert 
On Tue, 5 Oct 2010 15:34:41 +0200
Polytropon  wrote:

> On Tue, 5 Oct 2010 06:20:29 -0700, Robert  wrote:
> > Update
> > 
> > [r...@asus64] ~# dd if=/dev/da1 of=/1tb/disk500.img bs=1m
> > 476940+1 records in
> > 476940+1 records out
> > 500107862016 bytes transferred in 47027.134085 secs (10634453
> > bytes/sec)
> > 
> > ~ 14 hours later here is what I have.
> > 
> > [r...@asus64] ~# ls -l /1tb
> > total 488625218
> > drwxrwxr-x  2 root  operator   512 Jan 19  2010 .snap
> > -rw-r--r--  1 root  wheel 500107862016 Oct  5 01:07 disk500.img
> >   
> 
> You got a copy of the entire disk. This is GOOD as you're not
> missing something important.
> 
> 
> 
> > [r...@asus64] ~# mdconfig -a -t vnode -u 12 -f /1tb/disk500.img
> > [r...@asus64] ~# ls -l /dev/md*
> > crw-r-  1 root  operator0, 129 Oct  4 06:43 /dev/md10
> > crw-r-  1 root  operator0, 130 Oct  4 06:43 /dev/md10s1
> > crw-r-  1 root  operator0, 131 Oct  5 05:55 /dev/md12
> > crw-r-  1 root  operator0, 133 Oct  5 05:55 /dev/md12s1
> > crw---  1 root  wheel   0,  66 Oct  1 14:43 /dev/mdctl
> 
> Erm... erm erm erm!!! After using a md file that is connected to
> an image file, and you purge the image file, destroy the md file.
> Use "mdconfig -d -u 10" for unit 10, for example. See details in
> "man mdconfig".
> 
> 
> 
> > [r...@asus64] ~# mount_ntfs /dev/md12s1 /mnt
> > mount_ntfs: /dev/md12s1: Invalid argument
> 
> This is the 1st "primary partition" with NTFS content, this one
> can't be mounted.

As ntfs.

> 
> 
> 
> > [r...@asus64] ~# mount_ntfs /dev/md12 /mnt
> > [r...@asus64] ~# ls -l /mnt
> > total 70044
> > -rwxr-xr-x  1 root  wheel  2560 Dec 31  1600 $AttrDef
> > -rwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $BadClus
> > -rwxr-xr-x  1 root  wheel   4194304 Dec 31  1600 $Bitmap
> > -rwxr-xr-x  1 root  wheel  8192 Oct  1 09:09 $Boot
> > drwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $Extend
> > -rwxr-xr-x  1 root  wheel  67108864 Oct  1 09:09 $LogFile
> > -rwxr-xr-x  1 root  wheel  4096 Oct  1 09:09 $MFTMirr
> > -rwxr-xr-x  1 root  wheel 0 Dec 31  1600 $Secure
> > -rwxr-xr-x  1 root  wheel131072 Oct  1 09:09 $UpCase
> > -rwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $Volume
> > -rwxr-xr-x  1 root  wheel 45124 Aug 18  2001 NTDETECT.COM
> > drwxr-xr-x  1 root  wheel 0 Oct  1 17:29 System Volume
> > Information 
> > -rwxr-xr-x  1 root  wheel   193 Oct  1 09:12 boot.ini
> > -rwxr-xr-x  1 root  wheel222368 Aug 18  2001 ntldr
> > [r...@asus64] ~# umount /mnt
> 
> This is the second NTFS volume, can be mounted.

Without any of the data.

> 
> 
> 
> > [r...@asus64] ~# mount /dev/md12s1 /mnt
> 
> Why can the first one NOW be mounted???

As ufs
> 
> 
> 
> > [r...@asus64] ~# ls -l /mnt
> > total 0
> > [r...@asus64] ~# df -h
> > Filesystem   SizeUsed   Avail Capacity  Mounted on
> > /dev/label/rootfs989M523M387M57%/
> > devfs1.0K1.0K  0B   100%/dev
> > /dev/label/home  9.7G2.0G6.9G22%/home
> > /dev/label/slice2 56G 53G   -1.4G   103%/slice2
> > /dev/label/slice3 56G4.0K 52G 0%/slice3
> > /dev/label/slice4 56G 39G 13G76%/slice4
> > /dev/label/spare  20G6.0K 18G 0%/spare
> > /dev/label/tmp   484M 22M423M 5%/tmp
> > /dev/label/usr20G7.5G 11G40%/usr
> > /dev/label/var   989M158M752M17%/var
> > /dev/label/500ext451G153G262G37%/500ext
> > /dev/label/1tb   902G466G364G56%/1tb
> > /dev/ad12s1d 226G 59G149G28%/250extra
> > /dev/md12s1  451G 32G383G 8%/mnt
> >   ^^^
> 
> This looks like "missing data". In terms of UFS file system, one
> would say that there a inodes not referenced, but still occupied
> as they are not marked as being free.
> 
> Sadly, I have *zero* knowledge about NTFS to make an interpretation
> about what we see here...

> 
> Good luck!

Thanks for that :-)

> 
> 
> 
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re: OT: fdisk

2010-10-05 Thread Polytropon 
On Tue, 5 Oct 2010 06:20:29 -0700, Robert  wrote:
> Update
> 
> [r...@asus64] ~# dd if=/dev/da1 of=/1tb/disk500.img bs=1m
> 476940+1 records in
> 476940+1 records out
> 500107862016 bytes transferred in 47027.134085 secs (10634453 bytes/sec)
> 
> ~ 14 hours later here is what I have.
> 
> [r...@asus64] ~# ls -l /1tb
> total 488625218
> drwxrwxr-x  2 root  operator   512 Jan 19  2010 .snap
> -rw-r--r--  1 root  wheel 500107862016 Oct  5 01:07 disk500.img
>   

You got a copy of the entire disk. This is GOOD as you're not
missing something important.



> [r...@asus64] ~# mdconfig -a -t vnode -u 12 -f /1tb/disk500.img
> [r...@asus64] ~# ls -l /dev/md*
> crw-r-  1 root  operator0, 129 Oct  4 06:43 /dev/md10
> crw-r-  1 root  operator0, 130 Oct  4 06:43 /dev/md10s1
> crw-r-  1 root  operator0, 131 Oct  5 05:55 /dev/md12
> crw-r-  1 root  operator0, 133 Oct  5 05:55 /dev/md12s1
> crw---  1 root  wheel   0,  66 Oct  1 14:43 /dev/mdctl

Erm... erm erm erm!!! After using a md file that is connected to
an image file, and you purge the image file, destroy the md file.
Use "mdconfig -d -u 10" for unit 10, for example. See details in
"man mdconfig".



> [r...@asus64] ~# mount_ntfs /dev/md12s1 /mnt
> mount_ntfs: /dev/md12s1: Invalid argument

This is the 1st "primary partition" with NTFS content, this one
can't be mounted.



> [r...@asus64] ~# mount_ntfs /dev/md12 /mnt
> [r...@asus64] ~# ls -l /mnt
> total 70044
> -rwxr-xr-x  1 root  wheel  2560 Dec 31  1600 $AttrDef
> -rwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $BadClus
> -rwxr-xr-x  1 root  wheel   4194304 Dec 31  1600 $Bitmap
> -rwxr-xr-x  1 root  wheel  8192 Oct  1 09:09 $Boot
> drwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $Extend
> -rwxr-xr-x  1 root  wheel  67108864 Oct  1 09:09 $LogFile
> -rwxr-xr-x  1 root  wheel  4096 Oct  1 09:09 $MFTMirr
> -rwxr-xr-x  1 root  wheel 0 Dec 31  1600 $Secure
> -rwxr-xr-x  1 root  wheel131072 Oct  1 09:09 $UpCase
> -rwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $Volume
> -rwxr-xr-x  1 root  wheel 45124 Aug 18  2001 NTDETECT.COM
> drwxr-xr-x  1 root  wheel 0 Oct  1 17:29 System Volume
> Information 
> -rwxr-xr-x  1 root  wheel   193 Oct  1 09:12 boot.ini
> -rwxr-xr-x  1 root  wheel222368 Aug 18  2001 ntldr
> [r...@asus64] ~# umount /mnt

This is the second NTFS volume, can be mounted.



> [r...@asus64] ~# mount /dev/md12s1 /mnt

Why can the first one NOW be mounted???



> [r...@asus64] ~# ls -l /mnt
> total 0
> [r...@asus64] ~# df -h
> Filesystem   SizeUsed   Avail Capacity  Mounted on
> /dev/label/rootfs989M523M387M57%/
> devfs1.0K1.0K  0B   100%/dev
> /dev/label/home  9.7G2.0G6.9G22%/home
> /dev/label/slice2 56G 53G   -1.4G   103%/slice2
> /dev/label/slice3 56G4.0K 52G 0%/slice3
> /dev/label/slice4 56G 39G 13G76%/slice4
> /dev/label/spare  20G6.0K 18G 0%/spare
> /dev/label/tmp   484M 22M423M 5%/tmp
> /dev/label/usr20G7.5G 11G40%/usr
> /dev/label/var   989M158M752M17%/var
> /dev/label/500ext451G153G262G37%/500ext
> /dev/label/1tb   902G466G364G56%/1tb
> /dev/ad12s1d 226G 59G149G28%/250extra
> /dev/md12s1  451G 32G383G 8%/mnt
>   ^^^

This looks like "missing data". In terms of UFS file system, one
would say that there a inodes not referenced, but still occupied
as they are not marked as being free.

Sadly, I have *zero* knowledge about NTFS to make an interpretation
about what we see here...



> Everything is exactly the same as when I tried only 60GB. I am now
> going to zero the 1TB drive and dd the 500GB drive to it. 
> dd if=/dev/da1 of=/dev/ad6 bs=1m
> I will then try windows chkdsk on the 1TB drive. 

Maybe you need - after this transfer - to write the 512 byte blocks
at the beginning separately (dd if=/dev/da1 of=/dev/ad6 bs=512 count=1)?
Because of MBR and such?



> Thanks to everyone who has added input. If I can get this working I
> will summarize what it took to solve this puzzle.

Good luck!



-- 
Polytropon
Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re: OT: fdisk

2010-10-05 Thread Robert 
On Mon, 4 Oct 2010 07:52:21 -0700
Robert  wrote:

> On Mon, 4 Oct 2010 16:32:25 +0200
> Polytropon  wrote:
> 
> > On Mon, 4 Oct 2010 07:08:58 -0700, Robert 
> > wrote:
> > > I have now a free 1TB drive for use. It is formatted as UFS.
> > > Should I remove formatting before I dd the 500GB drive to it? 
> > 
> > Not needed, as you're going to use it under the control of FreeBSD.
> > After formatting and mounting it, let's say as /mnt, use dd (or
> > ddrescue) to first get an 1:1 copy of the source disk.
> > 
> 
> It is being performed even as we "speak".

Update

[r...@asus64] ~# dd if=/dev/da1 of=/1tb/disk500.img bs=1m
476940+1 records in
476940+1 records out
500107862016 bytes transferred in 47027.134085 secs (10634453 bytes/sec)

~ 14 hours later here is what I have.

[r...@asus64] ~# ls -l /1tb
total 488625218
drwxrwxr-x  2 root  operator   512 Jan 19  2010 .snap
-rw-r--r--  1 root  wheel 500107862016 Oct  5 01:07 disk500.img
  

[r...@asus64] ~# mdconfig -a -t vnode -u 12 -f /1tb/disk500.img
[r...@asus64] ~# ls -l /dev/md*
crw-r-  1 root  operator0, 129 Oct  4 06:43 /dev/md10
crw-r-  1 root  operator0, 130 Oct  4 06:43 /dev/md10s1
crw-r-  1 root  operator0, 131 Oct  5 05:55 /dev/md12
crw-r-  1 root  operator0, 133 Oct  5 05:55 /dev/md12s1
crw---  1 root  wheel   0,  66 Oct  1 14:43 /dev/mdctl
[r...@asus64] ~# mount_ntfs /dev/md12s1 /mnt
mount_ntfs: /dev/md12s1: Invalid argument
[r...@asus64] ~# mount_ntfs /dev/md12 /mnt
[r...@asus64] ~# ls -l /mnt
total 70044
-rwxr-xr-x  1 root  wheel  2560 Dec 31  1600 $AttrDef
-rwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $BadClus
-rwxr-xr-x  1 root  wheel   4194304 Dec 31  1600 $Bitmap
-rwxr-xr-x  1 root  wheel  8192 Oct  1 09:09 $Boot
drwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $Extend
-rwxr-xr-x  1 root  wheel  67108864 Oct  1 09:09 $LogFile
-rwxr-xr-x  1 root  wheel  4096 Oct  1 09:09 $MFTMirr
-rwxr-xr-x  1 root  wheel 0 Dec 31  1600 $Secure
-rwxr-xr-x  1 root  wheel131072 Oct  1 09:09 $UpCase
-rwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $Volume
-rwxr-xr-x  1 root  wheel 45124 Aug 18  2001 NTDETECT.COM
drwxr-xr-x  1 root  wheel 0 Oct  1 17:29 System Volume
Information 
-rwxr-xr-x  1 root  wheel   193 Oct  1 09:12 boot.ini
-rwxr-xr-x  1 root  wheel222368 Aug 18  2001 ntldr
[r...@asus64] ~# umount /mnt
[r...@asus64] ~# mount /dev/md12s1 /mnt
[r...@asus64] ~# ls -l /mnt
total 0
[r...@asus64] ~# df -h
Filesystem   SizeUsed   Avail Capacity  Mounted on
/dev/label/rootfs989M523M387M57%/
devfs1.0K1.0K  0B   100%/dev
/dev/label/home  9.7G2.0G6.9G22%/home
/dev/label/slice2 56G 53G   -1.4G   103%/slice2
/dev/label/slice3 56G4.0K 52G 0%/slice3
/dev/label/slice4 56G 39G 13G76%/slice4
/dev/label/spare  20G6.0K 18G 0%/spare
/dev/label/tmp   484M 22M423M 5%/tmp
/dev/label/usr20G7.5G 11G40%/usr
/dev/label/var   989M158M752M17%/var
/dev/label/500ext451G153G262G37%/500ext
/dev/label/1tb   902G466G364G56%/1tb
/dev/ad12s1d 226G 59G149G28%/250extra
/dev/md12s1  451G 32G383G 8%/mnt
  ^^^

Everything is exactly the same as when I tried only 60GB. I am now
going to zero the 1TB drive and dd the 500GB drive to it. 
dd if=/dev/da1 of=/dev/ad6 bs=1m
I will then try windows chkdsk on the 1TB drive. 

Thanks to everyone who has added input. If I can get this working I
will summarize what it took to solve this puzzle.

Henry wrote:

And still the wife doesn't suspect?

Of course she knows that the computer died and that I am in the process
of recovering all of her data. I re-installed XP Pro on another
computer and moved what data I did save onto it. She is happy that she
can check email, balance her check book and play on Facebook. :-)

We will be drinking wine tonight.

To be continued.

Robert
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re: OT: fdisk

2010-10-04 Thread Henry Olyer 
And still the wife doesn't suspect?



On Mon, Oct 4, 2010 at 2:42 PM, Robert  wrote:

> On Tue, 5 Oct 2010 03:53:09 +1100 (EST)
> Ian Smith  wrote:
>
> Ian
>
> I am in the process of dd the entire disk to a 1TB disk but I wanted to
> respond to you. You have given a lot of good advice and information and
> I appreciate it.
>
> >  > >  ~> fdisk /dev/da1
> >  > > *** Working on device /dev/da1 ***
> >  > > parameters extracted from in-core disklabel are:
> >  > > cylinders=60801 heads=255 sectors/track=63 (16065 blks/cyl)
> >  > >
> >  > > Figures below won't work with BIOS for partitions not in cyl 1
> >  > > parameters to be used for BIOS calculations are:
> >  > > cylinders=60801 heads=255 sectors/track=63 (16065 blks/cyl)
> >  > >
> >  > > Media sector size is 512
> >  > > Warning: BIOS sector numbering starts with sector 1
> >  > > Information from DOS bootblock is:
> >  > > The data for partition 1 is:
> >  > > sysid 7 (0x07),(NTFS, OS/2 HPFS, QNX-2 (16 bit) or Advanced UNIX)
> >  > > start 63, size 976773105 (476939 Meg), flag 0
> >  > >  beg: cyl 0/ head 1/ sector 1;
> >  > >  end: cyl 1023/ head 15/ sector 63
> >  > > The data for partition 2 is:
> >  > > 
> >  > > The data for partition 3 is:
> >  > > 
> >  > > The data for partition 4 is:
> >  > > 
> >
>
> >
> > So pausing here for a bit .. starting at 63 (cyl 0/ head 1/ sector1
> > in CHS terms), looks correct for s1, one slice, whole disk for NTFS.
> > That should rule out a damaged MBR in sector 0 - though it doesn't
> > rule out the boot code in the first 2 or so sectors having been
> > clobbered.
>
> I have tried earlier to explain what might/could have happened but was
> most likely not specific enough. I will try to do better.
>
> This was the wife's computer. It had Xp Pro on the first slice and
> FreeBSD 7.x on the second. Windows started acting strange and then was
> rebooting as soon as the desktop rendered. I booted to safe mode and
> went back one day in the recover option. Same thing happened, i.e.
> reboot after desktop rendered. I again booted in safe mode and went
> back two days. Could never get it to boot again even in safe mode.
>
> I booted into FreeBSD and copied some critical files off of the Windows
> slice that she was desperate to have. I put them on a pen drive so she
> could then access via her laptop.
>
> I checked the backup drive and saw that all was fine. I had the D$S
> stuff backing up nightly.
>
> I was able to mount either drive with _ntfs or ntfs-3g.
>
> No matter what I tried I could not get windows to boot even in safe
> mode. I left it running on FreeBSD aver night expecting to have to
> reinstall windows in the morning.
>
> The next day the system had rebooted with the GAG screen up. I ran
> memtest for about 6 hours and it showed a couple of faults. I pulled
> one of the three 512M memory chips and it seemed to run OK but still
> could not boot windows.
>
> I reinstalled windows and was doing all of the updates when it started
> failing to boot. Somewhere in that time the backup (500GB) drive became
> invisible to windows. FreeBSD showed only ad6 without the s1 partition.
> I used "sade" to look at it and it did not show as ntfs. I marked it as
> ntfs thinking that would fix it but it probably caused all of these
> problems.
>
> Whatever is wrong with that computer it now completely messed up. It
> will not even power on. I strapped out the power connect pins 3 and 4
> and the PS runs and the voltages check out.
>
> >
> > You can often poke around the beginning of disks to advantage with
> > say: # dd if=/dev/da1 bs=512 count=126 | hd | less
> > to see the first two tracks .. sector 63 should be where NTFS starts,
> > ie after sectors 0-62 on head 0.  hd(1) skips repeated zeroes or 0xff
> > and such, so you can hunt through quite a lot of early sectors
> > without huge output in less, usually.
> >
> >  > > Which looks a lot better. I can mount /dev/da1 and it shows
> >
> > Just to be clear, you mean: '# mount_ntfs /dev/da1 /mnt' ?
> >
> > (try to be sure to mount NTFS filesystems _explicitly_ read-only,
> > especially if likely damaged)
> >
> >  > >  ~> ls -l /mnt
> >  > > total 70044
> >  > > -rwxr-xr-x  1 root  wheel  2560 Dec 31  1600 $AttrDef
> >  > > -rwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $BadClus
> >  > > -rwxr-xr-x  1 root  wheel   4194304 Dec 31  1600 $Bitmap
> >  > > -rwxr-xr-x  1 root  wheel  8192 Oct  1 09:09 $Boot
> >  > > drwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $Extend
> >  > > -rwxr-xr-x  1 root  wheel  67108864 Oct  1 09:09 $LogFile
> >  > > -rwxr-xr-x  1 root  wheel  4096 Oct  1 09:09 $MFTMirr
> >  > > -rwxr-xr-x  1 root  wheel 0 Dec 31  1600 $Secure
> >  > > -rwxr-xr-x  1 root  wheel131072 Oct  1 09:09 $UpCase
> >  > > -rwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $Volume
> >  > > -rwxr-xr-x  1 root  wheel 45124 Aug 18  2001 NTDETECT.COM
> >  > > drwxr-xr-x  1 root  wheel 0 Oct  1 17:29 System Volume
> >  > > Informatio

Re: OT: fdisk

2010-10-04 Thread Robert 
On Tue, 5 Oct 2010 03:53:09 +1100 (EST)
Ian Smith  wrote:

Ian

I am in the process of dd the entire disk to a 1TB disk but I wanted to
respond to you. You have given a lot of good advice and information and
I appreciate it.

>  > >  ~> fdisk /dev/da1
>  > > *** Working on device /dev/da1 ***
>  > > parameters extracted from in-core disklabel are:
>  > > cylinders=60801 heads=255 sectors/track=63 (16065 blks/cyl)
>  > >
>  > > Figures below won't work with BIOS for partitions not in cyl 1
>  > > parameters to be used for BIOS calculations are:
>  > > cylinders=60801 heads=255 sectors/track=63 (16065 blks/cyl)
>  > >
>  > > Media sector size is 512
>  > > Warning: BIOS sector numbering starts with sector 1
>  > > Information from DOS bootblock is:
>  > > The data for partition 1 is:
>  > > sysid 7 (0x07),(NTFS, OS/2 HPFS, QNX-2 (16 bit) or Advanced UNIX)
>  > > start 63, size 976773105 (476939 Meg), flag 0
>  > >  beg: cyl 0/ head 1/ sector 1;
>  > >  end: cyl 1023/ head 15/ sector 63
>  > > The data for partition 2 is:
>  > > 
>  > > The data for partition 3 is:
>  > > 
>  > > The data for partition 4 is:
>  > > 
> 

> 
> So pausing here for a bit .. starting at 63 (cyl 0/ head 1/ sector1
> in CHS terms), looks correct for s1, one slice, whole disk for NTFS.
> That should rule out a damaged MBR in sector 0 - though it doesn't
> rule out the boot code in the first 2 or so sectors having been
> clobbered.

I have tried earlier to explain what might/could have happened but was
most likely not specific enough. I will try to do better.

This was the wife's computer. It had Xp Pro on the first slice and
FreeBSD 7.x on the second. Windows started acting strange and then was
rebooting as soon as the desktop rendered. I booted to safe mode and
went back one day in the recover option. Same thing happened, i.e.
reboot after desktop rendered. I again booted in safe mode and went
back two days. Could never get it to boot again even in safe mode.

I booted into FreeBSD and copied some critical files off of the Windows
slice that she was desperate to have. I put them on a pen drive so she
could then access via her laptop. 

I checked the backup drive and saw that all was fine. I had the D$S
stuff backing up nightly. 

I was able to mount either drive with _ntfs or ntfs-3g. 

No matter what I tried I could not get windows to boot even in safe
mode. I left it running on FreeBSD aver night expecting to have to
reinstall windows in the morning.

The next day the system had rebooted with the GAG screen up. I ran
memtest for about 6 hours and it showed a couple of faults. I pulled
one of the three 512M memory chips and it seemed to run OK but still
could not boot windows. 

I reinstalled windows and was doing all of the updates when it started
failing to boot. Somewhere in that time the backup (500GB) drive became
invisible to windows. FreeBSD showed only ad6 without the s1 partition.
I used "sade" to look at it and it did not show as ntfs. I marked it as
ntfs thinking that would fix it but it probably caused all of these
problems.

Whatever is wrong with that computer it now completely messed up. It
will not even power on. I strapped out the power connect pins 3 and 4
and the PS runs and the voltages check out.

> 
> You can often poke around the beginning of disks to advantage with
> say: # dd if=/dev/da1 bs=512 count=126 | hd | less
> to see the first two tracks .. sector 63 should be where NTFS starts,
> ie after sectors 0-62 on head 0.  hd(1) skips repeated zeroes or 0xff
> and such, so you can hunt through quite a lot of early sectors
> without huge output in less, usually.
> 
>  > > Which looks a lot better. I can mount /dev/da1 and it shows 
> 
> Just to be clear, you mean: '# mount_ntfs /dev/da1 /mnt' ?
> 
> (try to be sure to mount NTFS filesystems _explicitly_ read-only, 
> especially if likely damaged)
> 
>  > >  ~> ls -l /mnt
>  > > total 70044
>  > > -rwxr-xr-x  1 root  wheel  2560 Dec 31  1600 $AttrDef
>  > > -rwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $BadClus
>  > > -rwxr-xr-x  1 root  wheel   4194304 Dec 31  1600 $Bitmap
>  > > -rwxr-xr-x  1 root  wheel  8192 Oct  1 09:09 $Boot
>  > > drwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $Extend
>  > > -rwxr-xr-x  1 root  wheel  67108864 Oct  1 09:09 $LogFile
>  > > -rwxr-xr-x  1 root  wheel  4096 Oct  1 09:09 $MFTMirr
>  > > -rwxr-xr-x  1 root  wheel 0 Dec 31  1600 $Secure
>  > > -rwxr-xr-x  1 root  wheel131072 Oct  1 09:09 $UpCase
>  > > -rwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $Volume
>  > > -rwxr-xr-x  1 root  wheel 45124 Aug 18  2001 NTDETECT.COM
>  > > drwxr-xr-x  1 root  wheel 0 Oct  1 17:29 System Volume
>  > > Information 
>  > > -rwxr-xr-x  1 root  wheel   193 Oct  1 09:12 boot.ini
>  > > -rwxr-xr-x  1 root  wheel222368 Aug 18  2001 ntldr
>  > >
>  > > But I cannot mount /dev/da1s1
>  > >
>  > >  ~> sudo mount_ntfs /dev/da1s1 /mnt
>  > > mount_ntfs: /dev/da1s1: Invalid argument
> 
> Ok,

Re: OT: fdisk

2010-10-04 Thread Ian Smith 
In freebsd-questions Digest, Vol 331, Issue 1, Message: 5
On Sun, 3 Oct 2010 08:19:36 -0500 (CDT) Robert Bonomi 
 wrote:
 > > On Sat, 2 Oct 2010 17:00:00 -0600 (MDT)
 > > Warren Block  wrote:
 > >
 > > > On Sat, 2 Oct 2010, Robert wrote:
 > > > 
 > > > > Greetings
 > > > >
 > > > > I am in deep with the wife. Her computer went belly up. It was
 > > > > running XP pro and I had backups going to a second drive. I can no
 > > > > longer access that drive.
 > > > >
 > > > > I pulled it and attached it via USB to one of my FreeBSD machines
 > > > > but it will not mount. It is a 500G hard drive and I get _wild_
 > > > > results just looking at it with fdisk.
 > > > >
 > > > > ~> fdisk /dev/da1s1
 > > > > *** Working on device /dev/da1s1 ***
 > > > 
 > > > Wait a minute... shouldn't that be just "da1"?  da1s1 is the first
 > > > slice (partition), and the data there should be your XP filesystem,
 > > > probably NTFS.
 > >
 > > Warren,
 > >
 > > You are right. Here it is:
 > >
 > >  ~> fdisk /dev/da1
 > > *** Working on device /dev/da1 ***
 > > parameters extracted from in-core disklabel are:
 > > cylinders=60801 heads=255 sectors/track=63 (16065 blks/cyl)
 > >
 > > Figures below won't work with BIOS for partitions not in cyl 1
 > > parameters to be used for BIOS calculations are:
 > > cylinders=60801 heads=255 sectors/track=63 (16065 blks/cyl)
 > >
 > > Media sector size is 512
 > > Warning: BIOS sector numbering starts with sector 1
 > > Information from DOS bootblock is:
 > > The data for partition 1 is:
 > > sysid 7 (0x07),(NTFS, OS/2 HPFS, QNX-2 (16 bit) or Advanced UNIX)
 > > start 63, size 976773105 (476939 Meg), flag 0
 > >beg: cyl 0/ head 1/ sector 1;
 > >end: cyl 1023/ head 15/ sector 63
 > > The data for partition 2 is:
 > > 
 > > The data for partition 3 is:
 > > 
 > > The data for partition 4 is:
 > > 

Robert Bonomi, replying to yours before the above slipped away, but I'm 
directing this to Robert the OP, ok?

So pausing here for a bit .. starting at 63 (cyl 0/ head 1/ sector1 in 
CHS terms), looks correct for s1, one slice, whole disk for NTFS.  That 
should rule out a damaged MBR in sector 0 - though it doesn't rule out 
the boot code in the first 2 or so sectors having been clobbered.

You can often poke around the beginning of disks to advantage with say:
 # dd if=/dev/da1 bs=512 count=126 | hd | less
to see the first two tracks .. sector 63 should be where NTFS starts, ie 
after sectors 0-62 on head 0.  hd(1) skips repeated zeroes or 0xff and 
such, so you can hunt through quite a lot of early sectors without huge
output in less, usually.

 > > Which looks a lot better. I can mount /dev/da1 and it shows 

Just to be clear, you mean: '# mount_ntfs /dev/da1 /mnt' ?

(try to be sure to mount NTFS filesystems _explicitly_ read-only, 
especially if likely damaged)

 > >  ~> ls -l /mnt
 > > total 70044
 > > -rwxr-xr-x  1 root  wheel  2560 Dec 31  1600 $AttrDef
 > > -rwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $BadClus
 > > -rwxr-xr-x  1 root  wheel   4194304 Dec 31  1600 $Bitmap
 > > -rwxr-xr-x  1 root  wheel  8192 Oct  1 09:09 $Boot
 > > drwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $Extend
 > > -rwxr-xr-x  1 root  wheel  67108864 Oct  1 09:09 $LogFile
 > > -rwxr-xr-x  1 root  wheel  4096 Oct  1 09:09 $MFTMirr
 > > -rwxr-xr-x  1 root  wheel 0 Dec 31  1600 $Secure
 > > -rwxr-xr-x  1 root  wheel131072 Oct  1 09:09 $UpCase
 > > -rwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $Volume
 > > -rwxr-xr-x  1 root  wheel 45124 Aug 18  2001 NTDETECT.COM
 > > drwxr-xr-x  1 root  wheel 0 Oct  1 17:29 System Volume
 > > Information 
 > > -rwxr-xr-x  1 root  wheel   193 Oct  1 09:12 boot.ini
 > > -rwxr-xr-x  1 root  wheel222368 Aug 18  2001 ntldr
 > >
 > > But I cannot mount /dev/da1s1
 > >
 > >  ~> sudo mount_ntfs /dev/da1s1 /mnt
 > > mount_ntfs: /dev/da1s1: Invalid argument

Ok, and its not clear why/how mount_ntfs would be happy mounting da1 
'raw' but it sure looks like (at least part of) an NTFS root directory; 
not necessarily all what you'd see as C:\ in windows explorer, say; 
windows plays strange tricks the way it layers directories for display.

There's weird dates (1600?) and only you would know if those October 1st 
timestamps are of when you mounted it, or when windows last accessed it?

The fact that boot.ini is a few minutes later than some is interesting; 
that's where entries for multi-booting NT may exist, and maybe something 
messed with that, hardware glitch? or (not entirely unknown :) one of a 
hundred thousand or so viruses?

So, can you look at these files when so mounted?  Can you do something 
like 'du -d2 /mnt' and see anything useful?  I'm just guessing /hoping 
here that the disk may not be as badly scrambled as you fear, despite 
the apparent oddness of it mounting like that.

>From a later message, quoting Robert:

 > Warren, thanks for the link. I will be reading it and increasing my
 > understanding of

Re: OT: fdisk

2010-10-04 Thread Polytropon 
On Mon, 4 Oct 2010 07:52:21 -0700, Robert  wrote:
> On Mon, 4 Oct 2010 16:32:25 +0200
> Polytropon  wrote:
> [r...@asus64] ~# fdisk /dev/md10
> *** Working on device /dev/md10 ***
> parameters extracted from in-core disklabel are:
> cylinders=7648 heads=255 sectors/track=63 (16065 blks/cyl)
> 
> Figures below won't work with BIOS for partitions not in cyl 1
> parameters to be used for BIOS calculations are:
> cylinders=7648 heads=255 sectors/track=63 (16065 blks/cyl)
> 
> Media sector size is 512
> Warning: BIOS sector numbering starts with sector 1
> Information from DOS bootblock is:
> The data for partition 1 is:
> sysid 7 (0x07),(NTFS, OS/2 HPFS, QNX-2 (16 bit) or Advanced UNIX)
> start 63, size 976773105 (476939 Meg), flag 0
>   beg: cyl 0/ head 1/ sector 1;
>   end: cyl 1023/ head 15/ sector 63
> The data for partition 2 is:
> 
> The data for partition 3 is:
> 
> The data for partition 4 is:
> 

Okay, as I see it, this looks valid - a working partition table.
What can prevent mounting now is a defect in the NTFS MFT, everything
"after" the disk's partition table.



> > > [r...@asus64] ~# ls -l /dev/md*
> > > crw-r-  1 root  operator0, 129 Oct  4 06:43 /dev/md10
> > > crw-r-  1 root  operator0, 130 Oct  4 06:43 /dev/md10s1
> > > crw---  1 root  wheel   0,  66 Oct  1 14:43 /dev/mdctl
> > > [r...@asus64] ~# mount -o ro /dev/md10s1 /mnt
> > 
> > Good. At least a bit.
> 
> Is this the way to mount it, not _ntfs?

My fault: Using mount_ntfs is the correct way (or mount -t ntfs);
mount without options for a device / directory NOT listed in fstab
defaults to UFS.



> No. I was trying to just get the data to a 250GB drive. Now I am doing
> the 500GB to a 1TB drive and will follow up when complete.

Very good. You can check the progress by issuing ^T - dd will then
show a status message. If you're using ddrescue (no big difference
here), you'll get some more info, like this:

% ddrescue -d -r 3 -n /dev/ad1s1f ad1s1f.ddr log.txt
Press Ctrl-C to interrupt
Initial status (read from logfile)
rescued: 0 B,  errsize:   0 B,  errors:   0
Current status
rescued:90772 MB,  errsize:   0 B,  current rate:6815 kB/s
   ipos:90772 MB,   errors:   0,average rate:6723 kB/s
   opos:90772 MB
Finished

This example is 3h 45min for 80 GB from one (P)ATA disk to another.
You can watch the progress continuously here.


-- 
Polytropon
Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re: OT: fdisk

2010-10-04 Thread Polytropon 
On Sun, 3 Oct 2010 14:29:35 -0700, Robert  wrote:
> Thanks for the info. I successfully did the above and now I have a
> 58.6GB file named disk.img on a UFS disk.
> 
> Umm, what should I do now. Sorry for dumb question number 37 this
> weekend but I am a bit confused. Can I do just the opposite to another
> NTFS drive and end up with all the data looking like it should? I.E. dd
> from the file to an NTFS disk.

You can now use the file as if it were a disk. To "turn it into
a device", simply do

% mkdir mnt
% sudo mdconfig -a -t vnode -u 10 -f disk.img
% mount -o ro /dev/md10 mnt/

This should give you the chance to extract files from it. You
can also use fdisk on the /dev/md10 file (or any other unit
number given by -u you want to use).

I wouldn't dd the file back to the original drive, that might
make things worse.

For data extraction, I suggest dd'ing the WHOLE disk into an
image file and then working with this file, having the original
disk not touched anymore until the data is back.

See /usr/local/share/doc/sleuthkit/skins_ntfs.txt from TSK
(port: sleuthkit) for details about NTFS file recovery. As
you did show that you could mount the disk (I think you
presented a ls output with typical "Windows" files) this
should be possible again after fixing the partition table.

I have to admit that I've got NO CLUE about "Windows" file
systems as I don't use them, so I sadly can't be more specific.

You can also use ddrescue instead of dd, as it allows resuming
a dd operation, and it will dynamically adjust read block sizes,
so it might run faster.

% ddrescue -d -r 3 -n /dev/ad12 ntfs.ddr log.txt

If mounting does not work, you can use tools like photorec on
the /dev/md10 file which will extract known file types. The
tool magicrescue also could work:

% magicrescue -r /usr/local/share/magicrescue/recipes
-d mr_output /dev/md10





-- 
Polytropon
Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re: OT: fdisk

2010-10-04 Thread Robert 
On Mon, 4 Oct 2010 16:32:25 +0200
Polytropon  wrote:

> On Mon, 4 Oct 2010 07:08:58 -0700, Robert  wrote:
> > I have now a free 1TB drive for use. It is formatted as UFS. Should
> > I remove formatting before I dd the 500GB drive to it? 
> 
> Not needed, as you're going to use it under the control of FreeBSD.
> After formatting and mounting it, let's say as /mnt, use dd (or
> ddrescue) to first get an 1:1 copy of the source disk.
> 

It is being performed even as we "speak".

> 
> 
> > I tried the above process and here is what I have.
> > 
> > [r...@asus64] ~# mdconfig -a -t vnode -u 10 -f /250extra/disk.img 
> > [r...@asus64] ~# mount -o ro /dev/md10 /mnt
> > mount: /dev/md10 : Invalid argument
> 
> Of course. :-)
> 
> 
> 
> > [r...@asus64] ~# mount_ntfs -o ro /dev/md10 /mnt
> > mount_ntfs: /dev/md10: Input/output error
> 
> This indicates that the NTFS seems to be damaged and prevents
> mount_ntfs from mounting it. Start with "baby steps": Is there
> a valid partition table?
> 
>   # fdisk /dev/md10

[r...@asus64] ~# fdisk /dev/md10
*** Working on device /dev/md10 ***
parameters extracted from in-core disklabel are:
cylinders=7648 heads=255 sectors/track=63 (16065 blks/cyl)

Figures below won't work with BIOS for partitions not in cyl 1
parameters to be used for BIOS calculations are:
cylinders=7648 heads=255 sectors/track=63 (16065 blks/cyl)

Media sector size is 512
Warning: BIOS sector numbering starts with sector 1
Information from DOS bootblock is:
The data for partition 1 is:
sysid 7 (0x07),(NTFS, OS/2 HPFS, QNX-2 (16 bit) or Advanced UNIX)
start 63, size 976773105 (476939 Meg), flag 0
beg: cyl 0/ head 1/ sector 1;
end: cyl 1023/ head 15/ sector 63
The data for partition 2 is:

The data for partition 3 is:

The data for partition 4 is:


> 
> You should now get a partition table.
> 
> Did you create disk.img by dd'ing da0 or da0s1? This may matter.

da1...but not the entire disk.
> 
> 
> 
> > [r...@asus64] ~# ls -l /dev/md*
> > crw-r-  1 root  operator0, 129 Oct  4 06:43 /dev/md10
> > crw-r-  1 root  operator0, 130 Oct  4 06:43 /dev/md10s1
> > crw---  1 root  wheel   0,  66 Oct  1 14:43 /dev/mdctl
> > [r...@asus64] ~# mount -o ro /dev/md10s1 /mnt
> 
> Good. At least a bit.

Is this the way to mount it, not _ntfs?

> 
> 
> 
> > [r...@asus64] ~# ls -l /mnt
> > total 0
> > [r...@asus64] ~# df -h
> > Filesystem   SizeUsed   Avail Capacity  Mounted on
> > 
> > /dev/ad12s1d 226G 59G149G28%/250extra
> > /dev/md10s1  451G 32G383G 8%/mnt
> >   ^^^
> > [r...@asus64] ~# ls -la /mnt
> > total 0
> 
> Hmmm... you dd'ed the WHOLE disk to disk.img? Does the size look
> reasonable?

No. I was trying to just get the data to a 250GB drive. Now I am doing
the 500GB to a 1TB drive and will follow up when complete.

Robert
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re: OT: fdisk

2010-10-04 Thread Polytropon 
On Mon, 4 Oct 2010 07:08:58 -0700, Robert  wrote:
> I have now a free 1TB drive for use. It is formatted as UFS. Should I
> remove formatting before I dd the 500GB drive to it? 

Not needed, as you're going to use it under the control of FreeBSD.
After formatting and mounting it, let's say as /mnt, use dd (or
ddrescue) to first get an 1:1 copy of the source disk.



> I tried the above process and here is what I have.
> 
> [r...@asus64] ~# mdconfig -a -t vnode -u 10 -f /250extra/disk.img 
> [r...@asus64] ~# mount -o ro /dev/md10 /mnt
> mount: /dev/md10 : Invalid argument

Of course. :-)



> [r...@asus64] ~# mount_ntfs -o ro /dev/md10 /mnt
> mount_ntfs: /dev/md10: Input/output error

This indicates that the NTFS seems to be damaged and prevents
mount_ntfs from mounting it. Start with "baby steps": Is there
a valid partition table?

# fdisk /dev/md10

You should now get a partition table.

Did you create disk.img by dd'ing da0 or da0s1? This may matter.



> [r...@asus64] ~# ls -l /dev/md*
> crw-r-  1 root  operator0, 129 Oct  4 06:43 /dev/md10
> crw-r-  1 root  operator0, 130 Oct  4 06:43 /dev/md10s1
> crw---  1 root  wheel   0,  66 Oct  1 14:43 /dev/mdctl
> [r...@asus64] ~# mount -o ro /dev/md10s1 /mnt

Good. At least a bit.



> [r...@asus64] ~# ls -l /mnt
> total 0
> [r...@asus64] ~# df -h
> Filesystem   SizeUsed   Avail Capacity  Mounted on
> 
> /dev/ad12s1d 226G 59G149G28%/250extra
> /dev/md10s1  451G 32G383G 8%/mnt
>   ^^^
> [r...@asus64] ~# ls -la /mnt
> total 0

Hmmm... you dd'ed the WHOLE disk to disk.img? Does the size look
reasonable?



> > Warren wrote:
> > It will give an exact copy of the first 250G, which also means it
> > will not resize the 500G filesystem into a working 250G version.
> 
> Same questions as above. Can I dd to a 1TB? And what format on the
> drive?

Format the target disk as UFS, as you do with any disk you want to
use for FreeBSD. Then dd (or ddrescue) the source disk to a file on
that target disk. Then "connect" this file to a memory disk (md)
device. Check the fdisk output for that device. Mount it. Get your
data off.



> I apologize again if I am coming off as dense. I have not used "dd"
> before as I have always used dump for backups. 

Correct: dump + restore are used for UFS backups, but in this case,
you need to deal with "Windows" stuff that does not support such
standard means. That's why you need dd to make an 1:1 copy to work
with it as you would work on the original disk.




-- 
Polytropon
Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re: OT: fdisk

2010-10-04 Thread Robert 
On Mon, 4 Oct 2010 12:34:13 +0200
Polytropon  wrote:

> On Sun, 3 Oct 2010 14:29:35 -0700, Robert  wrote:
> > Thanks for the info. I successfully did the above and now I have a
> > 58.6GB file named disk.img on a UFS disk.
> > 
> > Umm, what should I do now. Sorry for dumb question number 37 this
> > weekend but I am a bit confused. Can I do just the opposite to
> > another NTFS drive and end up with all the data looking like it
> > should? I.E. dd from the file to an NTFS disk.
> 
> You can now use the file as if it were a disk. To "turn it into
> a device", simply do
> 
>   % mkdir mnt
>   % sudo mdconfig -a -t vnode -u 10 -f disk.img
>   % mount -o ro /dev/md10 mnt/
> 
> This should give you the chance to extract files from it. You
> can also use fdisk on the /dev/md10 file (or any other unit
> number given by -u you want to use).
> 

I have now a free 1TB drive for use. It is formatted as UFS. Should I
remove formatting before I dd the 500GB drive to it? 

I tried the above process and here is what I have.

[r...@asus64] ~# mdconfig -a -t vnode -u 10 -f /250extra/disk.img 
[r...@asus64] ~# mount -o ro /dev/md10 /mnt
mount: /dev/md10 : Invalid argument
[r...@asus64] ~# mount_ntfs -o ro /dev/md10 /mnt
mount_ntfs: /dev/md10: Input/output error
[r...@asus64] ~# ls -l /dev/md*
crw-r-  1 root  operator0, 129 Oct  4 06:43 /dev/md10
crw-r-  1 root  operator0, 130 Oct  4 06:43 /dev/md10s1
crw---  1 root  wheel   0,  66 Oct  1 14:43 /dev/mdctl
[r...@asus64] ~# mount -o ro /dev/md10s1 /mnt
[r...@asus64] ~# ls -l /mnt
total 0
[r...@asus64] ~# df -h
Filesystem   SizeUsed   Avail Capacity  Mounted on

/dev/ad12s1d 226G 59G149G28%/250extra
/dev/md10s1  451G 32G383G 8%/mnt
  ^^^
[r...@asus64] ~# ls -la /mnt
total 0

> Warren wrote:
> It will give an exact copy of the first 250G, which also means it
> will not resize the 500G filesystem into a working 250G version.

Same questions as above. Can I dd to a 1TB? And what format on the
drive?

I apologize again if I am coming off as dense. I have not used "dd"
before as I have always used dump for backups. 

Robert


___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re: OT: fdisk

2010-10-04 Thread Polytropon 
On Sun, 3 Oct 2010 22:27:02 -0600 (MDT), Warren Block  
wrote:
> On Sun, 3 Oct 2010, Polytropon wrote:
> 
> > On Sun, 3 Oct 2010 10:00:51 -0700, Robert  wrote:
> >> I have a spare 250G hard drive. Can I use "dd" to capture 250 gigs
> >> from the old drive? Using da1 and ad12 as the if and of will the result
> >> be an NTFS formatted 250g drive? Will I have the same results, i.e.
> >> able to mount ad12 but not ad12s1?
> >
> > Yes, as dd gives you an 1:1 copy of what you have.
> 
> It will give an exact copy of the first 250G, which also means it will 
> not resize the 500G filesystem into a working 250G version.
> 
> The first step would be a copy of the entire drive.  Then the filesystem 
> can be repaired and resized.

Exactly. NEVER mess with the precious data. Only read, then
store away the drive. If all files are back, the drive can
be cleanly reformatted and then populated with the original
files. All investigation and modification tasks should be
done with a copy. If you mess up a copy, get a new one.

As hard disks are cheap, it might be worth buying a new one
just to have enough disk space available for such tasks.
Remember: Hard disks are cheap, your data isn't. :-)


-- 
Polytropon
Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re: OT: fdisk

2010-10-04 Thread Zbigniew Komarnicki 
On Saturday 02 of October 2010 20:36:40 Robert wrote:
> Greetings

Maybe good tool will be System Rescue CD, Linux Live distribution, it has a 
tool named ntfs-3g and ntfsprogs. See here:
http://www.sysresccd.org/Main_Page
http://www.sysresccd.org/Sysresccd-manual-en_Mounting_an_NTFS_partition_with_full_Read-Write_support

> Thanks for any suggestions.

Good luck!

> Robert
Zbigniew
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re: OT: fdisk

2010-10-03 Thread Warren Block 

On Sun, 3 Oct 2010, Polytropon wrote:


On Sun, 3 Oct 2010 10:00:51 -0700, Robert  wrote:

I have a spare 250G hard drive. Can I use "dd" to capture 250 gigs
from the old drive? Using da1 and ad12 as the if and of will the result
be an NTFS formatted 250g drive? Will I have the same results, i.e.
able to mount ad12 but not ad12s1?


Yes, as dd gives you an 1:1 copy of what you have.


It will give an exact copy of the first 250G, which also means it will 
not resize the 500G filesystem into a working 250G version.


The first step would be a copy of the entire drive.  Then the filesystem 
can be repaired and resized.

___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re: OT: fdisk

2010-10-03 Thread Robert 
On Sun, 3 Oct 2010 19:40:45 +0200
Polytropon  wrote:

> On Sun, 3 Oct 2010 10:00:51 -0700, Robert  wrote:
> > I have a spare 250G hard drive. Can I use "dd" to capture 250 gigs
> > from the old drive? Using da1 and ad12 as the if and of will the
> > result be an NTFS formatted 250g drive? Will I have the same
> > results, i.e. able to mount ad12 but not ad12s1?
> 
> Yes, as dd gives you an 1:1 copy of what you have. If you intend
> to "experiment" on the partition (which means that you don't just
> do reading operations, but writing operations, too), and you're
> using FreeBSD for that, simply use dd's of= parameter to write to
> a file instead of directly to the partition; format the ad12 disk
> with UFS for that purpose. 
> 
Polytropon

Thanks for the info. I successfully did the above and now I have a
58.6GB file named disk.img on a UFS disk.

Umm, what should I do now. Sorry for dumb question number 37 this
weekend but I am a bit confused. Can I do just the opposite to another
NTFS drive and end up with all the data looking like it should? I.E. dd
from the file to an NTFS disk.

Robert


___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re: OT: fdisk

2010-10-03 Thread Polytropon 
On Sun, 3 Oct 2010 10:00:51 -0700, Robert  wrote:
> I have a spare 250G hard drive. Can I use "dd" to capture 250 gigs
> from the old drive? Using da1 and ad12 as the if and of will the result
> be an NTFS formatted 250g drive? Will I have the same results, i.e.
> able to mount ad12 but not ad12s1?

Yes, as dd gives you an 1:1 copy of what you have. If you intend
to "experiment" on the partition (which means that you don't just
do reading operations, but writing operations, too), and you're
using FreeBSD for that, simply use dd's of= parameter to write to
a file instead of directly to the partition; format the ad12 disk
with UFS for that purpose. 



> Should I zero out the 250g drive
> first?

No need, as dd should overwrite anything.



> Can "ddrescue" do a better job?

The ddrescue program has the ability to adjust reading block
size dynamically if reading errors occur. As you said, the
disk itself seems to be fine, so no job for ddrescue here.



> The Docs&Sets folders
> are the most important to recover so if I can access the data, I can
> burn it to DVD. 

If everything fails, use "The Sleuth Kit"; after installing it,
read /usr/local/share/doc/sleuthkit/skins_ntfs.txt for more
information.



-- 
Polytropon
Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re: OT: fdisk

2010-10-03 Thread Robert 
On Sun, 3 Oct 2010 08:19:36 -0500 (CDT)
Robert Bonomi  wrote:

> >
> > Which looks a lot better. I can mount /dev/da1 and it shows 
> >  ~> ls -l /mnt
> > total 70044
> > -rwxr-xr-x  1 root  wheel  2560 Dec 31  1600 $AttrDef
> > -rwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $BadClus
> > -rwxr-xr-x  1 root  wheel   4194304 Dec 31  1600 $Bitmap
> > -rwxr-xr-x  1 root  wheel  8192 Oct  1 09:09 $Boot
> > drwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $Extend
> > -rwxr-xr-x  1 root  wheel  67108864 Oct  1 09:09 $LogFile
> > -rwxr-xr-x  1 root  wheel  4096 Oct  1 09:09 $MFTMirr
> > -rwxr-xr-x  1 root  wheel 0 Dec 31  1600 $Secure
> > -rwxr-xr-x  1 root  wheel131072 Oct  1 09:09 $UpCase
> > -rwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $Volume
> > -rwxr-xr-x  1 root  wheel 45124 Aug 18  2001 NTDETECT.COM
> > drwxr-xr-x  1 root  wheel 0 Oct  1 17:29 System Volume
> > Information 
> > -rwxr-xr-x  1 root  wheel   193 Oct  1 09:12 boot.ini
> > -rwxr-xr-x  1 root  wheel222368 Aug 18  2001 ntldr
> >
> > But I cannot mount /dev/da1s1
> >
> >  ~> sudo mount_ntfs /dev/da1s1 /mnt
> > mount_ntfs: /dev/da1s1: Invalid argument
> 
> what does 'ls -l /dev/da1*' show?
> 

Robert

Just what one might expect

~> ls -l /dev/da1*
crw-rw  1 root  operator0, 129 Oct  2 07:46 /dev/da1
crw-rw  1 root  operator0,  92 Oct  2 16:43 /dev/da1s1


To all others who have answered: Thank you for all of your ideas. 

Warren, thanks for the link. I will be reading it and increasing my
understanding of NTFS.

I do not think there is anything physically wrong with the disk. I
just cannot reach the data on it. Using "photorec" I have all files
moved to a spare slice on this FreesBSD machine. It appears that there
is less than 60G of actual data on the drive. Most of it is not needed
so it will take quite awhile to sort the wanted from the unwanted.

I have a spare 250G hard drive. Can I use "dd" to capture 250 gigs
from the old drive? Using da1 and ad12 as the if and of will the result
be an NTFS formatted 250g drive? Will I have the same results, i.e.
able to mount ad12 but not ad12s1? Should I zero out the 250g drive
first? Can "ddrescue" do a better job?

This drive was used for a backup of of the Docs&Sets "folders" of the
XP drive. It also had music and photo files that are also on the
FreeBSD computer so they are not that critical. The Docs&Sets folders
are the most important to recover so if I can access the data, I can
burn it to DVD. 

Thanks again to all who have responded.

Robert
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re: OT: fdisk

2010-10-03 Thread Robert Bonomi 
> From owner-freebsd-questi...@freebsd.org  Sat Oct  2 18:51:14 2010
> Date: Sat, 2 Oct 2010 16:51:50 -0700
> From: Robert 
> To: Warren Block 
> Cc: "freebsd-questions@freebsd.org" 
> Subject: Re: OT: fdisk
>
> On Sat, 2 Oct 2010 17:00:00 -0600 (MDT)
> Warren Block  wrote:
>
> > On Sat, 2 Oct 2010, Robert wrote:
> > 
> > > Greetings
> > >
> > > I am in deep with the wife. Her computer went belly up. It was
> > > running XP pro and I had backups going to a second drive. I can no
> > > longer access that drive.
> > >
> > > I pulled it and attached it via USB to one of my FreeBSD machines
> > > but it will not mount. It is a 500G hard drive and I get _wild_
> > > results just looking at it with fdisk.
> > >
> > > ~> fdisk /dev/da1s1
> > > *** Working on device /dev/da1s1 ***
> > 
> > Wait a minute... shouldn't that be just "da1"?  da1s1 is the first
> > slice (partition), and the data there should be your XP filesystem,
> > probably NTFS.
>
> Warren,
>
> You are right. Here it is:
>
>  ~> fdisk /dev/da1
> *** Working on device /dev/da1 ***
> parameters extracted from in-core disklabel are:
> cylinders=60801 heads=255 sectors/track=63 (16065 blks/cyl)
>
> Figures below won't work with BIOS for partitions not in cyl 1
> parameters to be used for BIOS calculations are:
> cylinders=60801 heads=255 sectors/track=63 (16065 blks/cyl)
>
> Media sector size is 512
> Warning: BIOS sector numbering starts with sector 1
> Information from DOS bootblock is:
> The data for partition 1 is:
> sysid 7 (0x07),(NTFS, OS/2 HPFS, QNX-2 (16 bit) or Advanced UNIX)
> start 63, size 976773105 (476939 Meg), flag 0
>   beg: cyl 0/ head 1/ sector 1;
>   end: cyl 1023/ head 15/ sector 63
> The data for partition 2 is:
> 
> The data for partition 3 is:
> 
> The data for partition 4 is:
> 
>
> Which looks a lot better. I can mount /dev/da1 and it shows 
>  ~> ls -l /mnt
> total 70044
> -rwxr-xr-x  1 root  wheel  2560 Dec 31  1600 $AttrDef
> -rwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $BadClus
> -rwxr-xr-x  1 root  wheel   4194304 Dec 31  1600 $Bitmap
> -rwxr-xr-x  1 root  wheel  8192 Oct  1 09:09 $Boot
> drwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $Extend
> -rwxr-xr-x  1 root  wheel  67108864 Oct  1 09:09 $LogFile
> -rwxr-xr-x  1 root  wheel  4096 Oct  1 09:09 $MFTMirr
> -rwxr-xr-x  1 root  wheel 0 Dec 31  1600 $Secure
> -rwxr-xr-x  1 root  wheel131072 Oct  1 09:09 $UpCase
> -rwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $Volume
> -rwxr-xr-x  1 root  wheel 45124 Aug 18  2001 NTDETECT.COM
> drwxr-xr-x  1 root  wheel 0 Oct  1 17:29 System Volume
> Information 
> -rwxr-xr-x  1 root  wheel   193 Oct  1 09:12 boot.ini
> -rwxr-xr-x  1 root  wheel222368 Aug 18  2001 ntldr
>
> But I cannot mount /dev/da1s1
>
>  ~> sudo mount_ntfs /dev/da1s1 /mnt
> mount_ntfs: /dev/da1s1: Invalid argument

what does 'ls -l /dev/da1*' show?

___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re: OT: fdisk

2010-10-03 Thread Warren Block 

On Sun, 3 Oct 2010, Brandon Gooch wrote:

On Sat, Oct 2, 2010 at 9:45 PM, Robert  wrote:


I should have mentioned that before. dd was the first thing I tried.
I had an unused drive setup as UFS. Then did

dd if=/dev/da1s1 of=/dev/ad12s1d bs=1m count=2000


I believe that the above 'if' operand to dd should instead be /dev/da1
(without the 's1' slice). Also, the operand 'of' will need to point to
a device, such as /dev/ad12, or a file on a mounted file system, such
as /mnt/my_disk_image.img


Further, only the first 2G of a 500G NTFS filesystem will probably not 
be usable.  A quick search found this (old) article: 
http://ixbtlabs.com/articles/ntfs/

___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re: OT: fdisk

2010-10-03 Thread Polytropon 
On Sat, 2 Oct 2010 21:02:32 +0200, Patrick Lamaiziere  
wrote:
> Le Sat, 2 Oct 2010 11:36:40 -0700,
> Robert  a écrit :
> 
> > I tried to use "dd" and copy data to another spare drive. It appears
> > to work but then I can no longer mount that drive. Other than taking
> > it to a data recovery shop does anyone have any idea. 
> 
> May be "photorec" will help (in systutils/testdisk).
> http://www.cgsecurity.org/wiki/PhotoRec

You don't need an expensive recovery shop - FreeBSD has many good
tools for free. From my own experiences with data recovery, here's
a short list of tools to keep in mind (yes, photorec is on that
list, too - a very useful tool especially for use with SD and CF
cards from cameras):

System:
dd  <- the very fist thing you use
fsck_ffs<- doesn't apply here as "NTFS" != UFS
clri<- as well, as further others may
fsdb
fetch -rR 
recoverdisk

Ports:
ddrescue<- if dd doesn't work
dd_rescue   <- as well
ffs2recov
magicrescue
testdisk
photorec
scan_ffs
recoverjpeg
foremost
The Sleuth Kit: <- if everything fails
fls
dls
ils
autopsy

As I mentioned, work with copies only. If you have a disk big
enough (disks aren't cheap today, your data isn't), make a copy
of the copy and work with that. If you accidentally screw up the
copy, delete it and make a new working copy from the master copy.
Do not touch the original disk until you're done - and SURE about
being done.

If you fail to reconstruct the partition table, you can still get
the "bare data", even in form of separate files. Some of the
recovery programs listed above are able to process input data
where all partition and file system information is lost, i. e.
they operate on byte level (blocks) and contain algorithms to
determine files (begin, end, kind, magic). Allthough this work
often results in the loss of file names and directory structures,
the files theirselves come back.

I've experienced a similar kind of data loss in the past, so I
wish you good luck with recovery.

For the future: Make backups. Lesson learned. :-)




-- 
Polytropon
Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re: OT: fdisk

2010-10-03 Thread Polytropon 
On Sun, 3 Oct 2010 01:15:06 -0500, Brandon Gooch  
wrote:
> I believe that the above 'if' operand to dd should instead be /dev/da1
> (without the 's1' slice). Also, the operand 'of' will need to point to
> a device, such as /dev/ad12, or a file on a mounted file system, such
> as /mnt/my_disk_image.img

A good advice. Also: You should, when in doubt, never, NEVER operate
on the disk you want to restore data from. Dump the whole disk into
a file and operate on THAT file. Use mdconfig to make it a block
device if needed.


-- 
Polytropon
Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re: OT: fdisk

2010-10-02 Thread Brandon Gooch 
On Sat, Oct 2, 2010 at 9:45 PM, Robert  wrote:
> On Sat, 2 Oct 2010 19:09:27 -0600 (MDT)
> Warren Block  wrote:
>
>
>> It's weird that da1 can be mounted, but da1s1 can't.  Maybe a problem
>> with the filesystem.  Might be repairable, although probably it would
>> need proprietary programs.  Don't experiment with the original drive,
>> make a copy with dd for experimenting.
>
> Warren
>
> I should have mentioned that before. dd was the first thing I tried.
> I had an unused drive setup as UFS. Then did
>
> dd if=/dev/da1s1 of=/dev/ad12s1d bs=1m count=2000

I believe that the above 'if' operand to dd should instead be /dev/da1
(without the 's1' slice). Also, the operand 'of' will need to point to
a device, such as /dev/ad12, or a file on a mounted file system, such
as /mnt/my_disk_image.img

-Brandon
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re: OT: fdisk

2010-10-02 Thread Robert 
On Sat, 2 Oct 2010 19:09:27 -0600 (MDT)
Warren Block  wrote:


> It's weird that da1 can be mounted, but da1s1 can't.  Maybe a problem 
> with the filesystem.  Might be repairable, although probably it would 
> need proprietary programs.  Don't experiment with the original drive, 
> make a copy with dd for experimenting.

Warren

I should have mentioned that before. dd was the first thing I tried.
I had an unused drive setup as UFS. Then did

dd if=/dev/da1s1 of=/dev/ad12s1d bs=1m count=2000  

thinking I could try the first two gigabytes and then go from
there. It look like it went fine but then I could not mount the ad12s1d
partition. It was able to mount it previously. 

Going back even further, When I first realized there was a problem
with this drive, I booted with 8.1 livefs. The drive had lost it's id
that showed it was NTFS. I used "sade" and marked it as NTFS but was
never able to mount it. It is very possible that I messed it up but I
was having all sorts of problems with that computer and XP pro doesn't
exactly help one out.

Thanks again for your time.

Robert
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re: OT: fdisk

2010-10-02 Thread Warren Block 

On Sat, 2 Oct 2010, Robert wrote:


But I cannot mount /dev/da1s1

~> sudo mount_ntfs /dev/da1s1 /mnt
mount_ntfs: /dev/da1s1: Invalid argument


It's weird that da1 can be mounted, but da1s1 can't.  Maybe a problem 
with the filesystem.  Might be repairable, although probably it would 
need proprietary programs.  Don't experiment with the original drive, 
make a copy with dd for experimenting.

___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re: OT: fdisk

2010-10-02 Thread Robert 
On Sat, 2 Oct 2010 17:00:00 -0600 (MDT)
Warren Block  wrote:

> On Sat, 2 Oct 2010, Robert wrote:
> 
> > Greetings
> >
> > I am in deep with the wife. Her computer went belly up. It was
> > running XP pro and I had backups going to a second drive. I can no
> > longer access that drive.
> >
> > I pulled it and attached it via USB to one of my FreeBSD machines
> > but it will not mount. It is a 500G hard drive and I get _wild_
> > results just looking at it with fdisk.
> >
> > ~> fdisk /dev/da1s1
> > *** Working on device /dev/da1s1 ***
> 
> Wait a minute... shouldn't that be just "da1"?  da1s1 is the first
> slice (partition), and the data there should be your XP filesystem,
> probably NTFS.

Warren,

You are right. Here it is:

 ~> fdisk /dev/da1
*** Working on device /dev/da1 ***
parameters extracted from in-core disklabel are:
cylinders=60801 heads=255 sectors/track=63 (16065 blks/cyl)

Figures below won't work with BIOS for partitions not in cyl 1
parameters to be used for BIOS calculations are:
cylinders=60801 heads=255 sectors/track=63 (16065 blks/cyl)

Media sector size is 512
Warning: BIOS sector numbering starts with sector 1
Information from DOS bootblock is:
The data for partition 1 is:
sysid 7 (0x07),(NTFS, OS/2 HPFS, QNX-2 (16 bit) or Advanced UNIX)
start 63, size 976773105 (476939 Meg), flag 0
beg: cyl 0/ head 1/ sector 1;
end: cyl 1023/ head 15/ sector 63
The data for partition 2 is:

The data for partition 3 is:

The data for partition 4 is:


Which looks a lot better. I can mount /dev/da1 and it shows 
 ~> ls -l /mnt
total 70044
-rwxr-xr-x  1 root  wheel  2560 Dec 31  1600 $AttrDef
-rwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $BadClus
-rwxr-xr-x  1 root  wheel   4194304 Dec 31  1600 $Bitmap
-rwxr-xr-x  1 root  wheel  8192 Oct  1 09:09 $Boot
drwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $Extend
-rwxr-xr-x  1 root  wheel  67108864 Oct  1 09:09 $LogFile
-rwxr-xr-x  1 root  wheel  4096 Oct  1 09:09 $MFTMirr
-rwxr-xr-x  1 root  wheel 0 Dec 31  1600 $Secure
-rwxr-xr-x  1 root  wheel131072 Oct  1 09:09 $UpCase
-rwxr-xr-x  1 root  wheel 0 Oct  1 09:09 $Volume
-rwxr-xr-x  1 root  wheel 45124 Aug 18  2001 NTDETECT.COM
drwxr-xr-x  1 root  wheel 0 Oct  1 17:29 System Volume
Information 
-rwxr-xr-x  1 root  wheel   193 Oct  1 09:12 boot.ini
-rwxr-xr-x  1 root  wheel222368 Aug 18  2001 ntldr

But I cannot mount /dev/da1s1

 ~> sudo mount_ntfs /dev/da1s1 /mnt
mount_ntfs: /dev/da1s1: Invalid argument

Patrick wrote

May be "photorec" will help (in systutils/testdisk).
http://www.cgsecurity.org/wiki/PhotoRec

I installed this and can successfully recover the date to a spare
slice. The problem is the data is all over the place. There is a ton if
png files from her playing games on facebook. This can be better than
nothing because I can go through the files and move/rename the ones we
want to keep.

Thank you both. I am willing to try any other suggestions. It appears
the the motherboard went gradually bad and hosed up this drive.

Robert
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re: OT: fdisk

2010-10-02 Thread Warren Block 

On Sat, 2 Oct 2010, Robert wrote:


Greetings

I am in deep with the wife. Her computer went belly up. It was running
XP pro and I had backups going to a second drive. I can no longer access
that drive.

I pulled it and attached it via USB to one of my FreeBSD machines but
it will not mount. It is a 500G hard drive and I get _wild_ results just
looking at it with fdisk.

~> fdisk /dev/da1s1
*** Working on device /dev/da1s1 ***


Wait a minute... shouldn't that be just "da1"?  da1s1 is the first slice 
(partition), and the data there should be your XP filesystem, probably 
NTFS.

___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re: OT: fdisk

2010-10-02 Thread Svein Skogen (Listmail account) 
On 02.10.2010 21:08, Jerry wrote:
> On Sat, 2 Oct 2010 11:36:40 -0700
> Robert  articulated:
> 
>> I am in deep with the wife. Her computer went belly up. It was running
>> XP pro and I had backups going to a second drive. I can no longer
>> access that drive.
> 
> If the disk is the problem, I would suggest getting a copy of Spin-Rite
>  and running it at level 6 .
> It is the best disk recovery program I have come across.

+1 to that. I've been using spinrite for more than a decade, and have
lost count of the times it has saved data for me (or rather: For people
dumping their crashed pc in my lap, since _I_ have _BACKUPS_).

When you're done recovering data, you might want to take a look at your
backup strategy. Select a new one that doesn't depend on spinning metal
just as fragile as the one you're backing up from.

//Svein

-- 
+---+---
  /"\   |Svein Skogen   | sv...@d80.iso100.no
  \ /   |Solberg Østli 9| PGP Key:  0xE5E76831
   X|2020 Skedsmokorset | sv...@jernhuset.no
  / \   |Norway | PGP Key:  0xCE96CE13
|   | sv...@stillbilde.net
 ascii  |   | PGP Key:  0x58CD33B6
 ribbon |System Admin   | svein-listm...@stillbilde.net
Campaign|stillbilde.net | PGP Key:  0x22D494A4
+---+---
|msn messenger: | Mobile Phone: +47 907 03 575
|sv...@jernhuset.no | RIPE handle:SS16503-RIPE
+---+---
 If you really are in a hurry, mail me at
   svein-mob...@stillbilde.net
 This mailbox goes directly to my cellphone and is checked
even when I'm not in front of my computer.

 Picture Gallery:
  https://gallery.stillbilde.net/v/svein/




signature.asc
Description: OpenPGP digital signature

Re: OT: fdisk

2010-10-02 Thread Jerry 
On Sat, 2 Oct 2010 11:36:40 -0700
Robert  articulated:

> I am in deep with the wife. Her computer went belly up. It was running
> XP pro and I had backups going to a second drive. I can no longer
> access that drive.

If the disk is the problem, I would suggest getting a copy of Spin-Rite
 and running it at level 6 .
It is the best disk recovery program I have come across.

-- 
Jerry ✌
freebsd.u...@seibercom.net

Disclaimer: off-list followups get on-list replies or get ignored.
Please do not ignore the Reply-To header.
__
History books which contain no lies are extremely dull.
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Re: OT: fdisk

2010-10-02 Thread Patrick Lamaiziere 
Le Sat, 2 Oct 2010 11:36:40 -0700,
Robert  a écrit :

> I tried to use "dd" and copy data to another spare drive. It appears
> to work but then I can no longer mount that drive. Other than taking
> it to a data recovery shop does anyone have any idea. 

May be "photorec" will help (in systutils/testdisk).
http://www.cgsecurity.org/wiki/PhotoRec

Good luck!
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"