Need help from someone who's good with data recovery and knows cfdisk more than most!

**Lostfarmer** · 09-06-2009

Normally if some one has lost a partition would suggest running 'testdisk', it will do a good job on a normal partition setup. But in you case with a primary partition inside of the logical partition it likely will make a total mess. You could use it to find the partition ,list its start/stop sector's and use that info. Just do not update/write the MBR/EPT with it.

**dav7** · 09-07-2009

Originally Posted by Lostfarmer

Normally if some one has lost a partition would suggest running 'testdisk', it will do a good job on a normal partition setup. But in you case with a primary partition inside of the logical partition it likely will make a total mess. You could use it to find the partition ,list its start/stop sector's and use that info. Just do not update/write the MBR/EPT with it.

It's slightly embarrasing but, uh, I originally used testdisk to try and get the filesystem back before it was in the mess it's in now. So I did exactly what you mentioned... make a total mess.

Originally Posted by Lostfarmer

The display of 'sda9ept' is an EPT, so will decode it for you.

Code:

000001b0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe  
000001c0  ff ff 83 fe ff ff 3f 00 00 00 7f 32 0f 00 00 fe  
000001d0  ff ff 0f fe ff ff 1d e8 f3 06 7c 65 1e 00

Okay, I'm a little confused... my sda9 EPT dump shows:

Code:

000001b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 fe  |................|
000001c0  ff ff 83 fe ff ff 3f 00  00 00 7f 32 0f 00 00 fe  |......?....2....|
000001d0  ff ff 05 fe ff ff 1d e8  f3 06 7c 65 1e 00 00 00  |..........|e....|

You said:

Code:

000001b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 fe  |................|
000001c0  ff ff 83 fe ff ff 3f 00  00 00 7f 32 0f 00 00 fe  |......?....2....|
000001d0  ff ff 0f fe ff ff 1d e8  f3 06 7c 65 1e 00 00 00  |..........|e....|

Which is which?

Originally Posted by Lostfarmer

(You need to verify if indeed an EPT so use skip=116776484)

Doesn't look like it

Code:

/Users/dav7/ + dd if=/dev/sda of=ept bs=512 count=1 skip=116776484
1+0 records in
1+0 records out
512 bytes (512 B) copied, 0.0150888 s, 33.9 kB/s
/Users/dav7/ + hexdump -C ept
00000000  65 20 77 65 72 79 20 67  61 79 20 75 69 0d 0a 22  |e wery gay ui.."|
00000010  0a 54 68 75 20 4d 61 79  20 31 30 20 30 35 3a 31  |.Thu May 10 05:1|
00000020  35 3a 35 37 20 32 30 30  37 20 2d 20 53 4f 43 4b  |5:57 2007 - SOCK|
00000030  45 54 20 2d 20 50 72 6f  63 65 73 73 69 6e 67 20  |ET - Processing |
00000040  22 3a 6d 61 6b 69 21 6e  3d 6d 61 6b 69 40 36 32  |":maki!n=maki@62|
00000050  2e 31 36 32 2e 32 32 31  2e 34 35 20 50 52 49 56  |.162.221.45 PRIV|
00000060  4d 53 47 20 23 23 77 69  6e 64 6f 77 73 20 3a 61  |MSG ##windows :a|
00000070  70 70 6c 65 20 68 61 73  65 20 77 65 72 79 20 67  |pple hase wery g|
00000080  61 79 20 75 69 22 0a 54  68 75 20 4d 61 79 20 31  |ay ui".Thu May 1|
00000090  30 20 30 35 3a 31 35 3a  35 38 20 32 30 30 37 20  |0 05:15:58 2007 |
000000a0  2d 20 53 4f 43 4b 45 54  20 2d 20 53 6f 63 6b 65  |- SOCKET - Socke|
000000b0  74 20 52 65 63 65 69 76  65 64 20 32 32 31 20 62  |t Received 221 b|
000000c0  79 74 65 73 3a 20 22 3a  66 65 72 72 65 74 5f 30  |ytes: ":ferret_0|
000000d0  35 36 37 21 6e 3d 66 65  72 72 65 74 5f 30 40 63  |567!n=ferret_0@c|
000000e0  70 65 2d 37 32 2d 31 38  33 2d 32 33 31 2d 31 31  |pe-72-183-231-11|
000000f0  30 2e 73 61 74 78 2e 72  65 73 2e 72 72 2e 63 6f  |0.satx.res.rr.co|
00000100  6d 20 50 52 49 56 4d 53  47 20 23 23 77 69 6e 64  |m PRIVMSG ##wind|
00000110  6f 77 73 20 3a 79 65 73  0d 0a 3a 44 61 6e 69 5f  |ows :yes..:Dani_|
00000120  21 6e 3d 63 68 61 74 7a  69 6c 6c 40 43 50 45 30  |!n=chatzill@CPE0|
00000130  30 32 30 65 64 37 33 30  62 33 31 2d 43 4d 30 30  |020ed730b31-CM00|
00000140  31 32 63 39 39 39 65 65  61 30 2e 63 70 65 2e 6e  |12c999eea0.cpe.n|
00000150  65 74 2e 63 61 62 6c 65  2e 72 6f 67 65 72 73 2e  |et.cable.rogers.|
00000160  63 6f 6d 20 50 52 49 56  4d 53 47 20 23 43 53 53  |com PRIVMSG #CSS|
00000170  20 3a 79 6f 75 20 77 69  6c 6c 20 73 65 65 20 74  | :you will see t|
00000180  68 65 20 63 6f 6e 74 65  6e 74 20 61 6e 64 20 61  |he content and a|
00000190  20 72 6f 77 20 6f 66 20  62 75 74 74 6f 6e 73 2e  | row of buttons.|
000001a0  2e 2e 0d 0a 22 0a 54 68  75 20 4d 61 79 20 31 30  |....".Thu May 10|
000001b0  20 30 35 3a 31 35 3a 35  38 20 32 30 30 37 20 2d  | 05:15:58 2007 -|
000001c0  20 53 4f 43 4b 45 54 20  2d 20 50 72 6f 63 65 73  | SOCKET - Proces|
000001d0  73 69 6e 67 20 22 3a 66  65 72 72 65 74 5f 30 35  |sing ":ferret_05|
000001e0  36 37 21 6e 3d 66 65 72  72 65 74 5f 30 40 63 70  |67!n=ferret_0@cp|
000001f0  65 2d 37 32 2d 31 38 33  2d 32 33 31 2d 31 31 30  |e-72-183-231-110|
00000200

Originally Posted by Lostfarmer

What we do not know yet is just where partition start.
Must find basic data as above on sda6 ,so we know how many pri sectors must be included. On an ext2 it would be the third sector '0x400 -0x5ff' but on a JFS1 it is not there.

Sorry... you've lost me at this point

What am I looking for again?

Originally Posted by Lostfarmer

(dd if=/dev/sda6 of=sda6ept bs=512 count=3) You will have to search till you find it. Can use 'count=64 ,if still not found use skip=64 count=64, ect. 'First try with skip=64 count=3'

I'm not entirely sure what I'm doing here, but interesting stuff is happening...

Not much at first...

Code:

/Users/dav7/ + dd if=/dev/sda6 bs=512 count=3 | hexdump -C
3+0 records in
3+0 records out
1536 bytes (1.5 kB) copied, 4.6372e-05 s, 33.1 MB/s
00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000600

And again...

Code:

/Users/dav7/ + dd if=/dev/sda6 bs=512 count=64 | hexdump -C
64+0 records in
64+0 records out
32768 bytes (33 kB) copied, 0.000701234 s, 46.7 MB/s
00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00008000

HOWEVER.... take a look at this! TWO JFS1 headers! The other one's near the bottom.

Code:

/Users/dav7/ + dd if=/dev/sda6 bs=512 count=64 skip=64 | hexdump -C
64+0 records in
64+0 records out
32768 bytes (33 kB) copied, 0.000286231 s, 114 MB/s
00000000  4a 46 53 31 01 00 00 00  68 b8 3f 00 00 00 00 00  |JFS1....h.?.....|
00000010  00 10 00 00 0c 00 03 00  00 02 00 00 09 00 00 00  |................|
00000020  00 20 00 00 00 09 20 10  01 00 00 00 00 00 00 00  |. .... .........|
00000030  04 00 00 00 57 00 00 00  02 00 00 00 55 00 00 00  |....W.......U...|
00000040  06 08 00 00 ef 00 00 00  00 08 00 00 50 f7 07 00  |............P...|
00000050  43 00 00 00 0d f7 07 00  82 bc db 47 00 00 00 00  |C..........G....|
00000060  32 00 00 00 02 00 00 00  00 00 00 00 00 00 00 00  |2...............|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  7b b5 df 89 3a 90 4c 92  |........{...:.L.|
00000090  8a a7 a9 42 71 80 60 87  00 00 00 00 00 00 00 00  |...Bq.`.........|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00001000  ff ff ff ff 01 00 00 00  20 00 00 00 1a 00 00 00  |........ .......|
00001010  04 00 00 00 02 00 00 00  00 00 00 00 00 00 00 00  |................|
00001020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00001800  00 00 00 00 00 00 00 00  20 00 00 00 1a 00 00 00  |........ .......|
00001810  ff ff ff ff ff ff ff ff  00 00 00 00 00 00 00 00  |................|
*
00002000  00 00 00 00 00 00 00 00  00 00 00 00 ff ff ff ff  |................|
00002010  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00002020  ff ff ff 7f ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00002030  00 00 00 80 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00002040  1a 00 00 00 7f 00 00 00  00 00 00 00 00 00 00 00  |................|
00002050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00002800  00 80 00 f8 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00002810  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00002a00  00 80 00 f8 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00002a10  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00002c00  04 00 00 00 0b 00 00 00  00 00 00 00 00 00 00 00  |................|
00002c10  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00003020  00 00 00 00 00 00 00 00  01 00 00 00 00 00 00 00  |................|
00003030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00003200  82 bc db 47 01 00 00 00  01 00 00 00 01 00 00 00  |...G............|
00003210  04 00 00 00 0b 00 00 00  00 20 00 00 00 00 00 00  |......... ......|
00003220  02 00 00 00 00 00 00 00  01 00 00 00 00 00 00 00  |................|
00003230  00 00 00 00 00 80 01 00  82 bc db 47 00 00 00 00  |...........G....|
00003240  82 bc db 47 00 00 00 00  82 bc db 47 00 00 00 00  |...G.......G....|
00003250  82 bc db 47 00 00 00 00  00 00 00 00 00 00 00 00  |...G............|
00003260  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00003270  00 00 00 00 00 00 00 00  02 00 00 00 00 00 00 00  |................|
00003280  00 00 00 00 01 00 00 00  00 00 00 00 00 00 00 00  |................|
00003290  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000032f0  83 00 03 00 12 00 00 00  00 00 00 00 00 00 00 00  |................|
00003300  00 00 00 00 00 00 00 00  02 00 00 00 09 00 00 00  |................|
00003310  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00003400  82 bc db 47 01 00 00 00  02 00 00 00 01 00 00 00  |...G............|
00003410  04 00 00 00 0b 00 00 00  00 50 04 00 00 00 00 00  |.........P......|
00003420  45 00 00 00 00 00 00 00  01 00 00 00 00 00 00 00  |E...............|
00003430  00 00 00 00 00 80 01 00  82 bc db 47 00 00 00 00  |...........G....|
00003440  82 bc db 47 00 00 00 00  82 bc db 47 00 00 00 00  |...G.......G....|
00003450  82 bc db 47 00 00 00 00  00 00 00 00 00 00 00 00  |...G............|
00003460  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00003470  00 00 00 00 00 00 00 00  02 00 00 00 00 00 00 00  |................|
00003480  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000034f0  83 00 03 00 12 00 00 00  00 00 00 00 00 00 00 00  |................|
00003500  00 00 00 00 00 00 00 00  45 00 00 00 10 00 00 00  |........E.......|
00003510  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00003600  82 bc db 47 01 00 00 00  03 00 00 00 01 00 00 00  |...G............|
00003610  04 00 00 00 0b 00 00 00  00 00 00 00 00 00 00 00  |................|
00003620  00 00 00 00 00 00 00 00  01 00 00 00 00 00 00 00  |................|
00003630  00 00 00 00 00 80 01 00  82 bc db 47 00 00 00 00  |...........G....|
00003640  82 bc db 47 00 00 00 00  82 bc db 47 00 00 00 00  |...G.......G....|
00003650  82 bc db 47 00 00 00 00  00 00 00 00 00 00 00 00  |...G............|
00003660  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00003670  00 00 00 00 00 00 00 00  02 00 00 00 00 00 00 00  |................|
00003680  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000036f0  83 00 02 00 12 00 00 00  00 00 00 00 00 00 00 00  |................|
00003700  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00003800  82 bc db 47 01 00 00 00  04 00 00 00 01 00 00 00  |...G............|
00003810  04 00 00 00 0b 00 00 00  00 00 00 00 00 00 00 00  |................|
00003820  00 00 00 00 00 00 00 00  01 00 00 00 00 00 00 00  |................|
00003830  00 00 00 00 00 80 03 00  82 bc db 47 00 00 00 00  |...........G....|
00003840  82 bc db 47 00 00 00 00  82 bc db 47 00 00 00 00  |...G.......G....|
00003850  82 bc db 47 00 00 00 00  00 00 00 00 00 00 00 00  |...G............|
00003860  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00003870  00 00 00 00 00 00 00 00  02 00 00 00 00 00 00 00  |................|
00003880  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000038f0  83 00 02 00 12 00 00 00  00 00 00 00 00 00 00 00  |................|
00003900  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00005000  82 bc db 47 01 00 00 00  10 00 00 00 01 00 00 00  |...G............|
00005010  04 00 00 00 0b 00 00 00  00 10 04 00 00 00 00 00  |................|
00005020  42 00 00 00 00 00 00 00  01 00 00 00 00 00 00 00  |B...............|
00005030  00 00 00 00 00 80 01 00  82 bc db 47 00 00 00 00  |...........G....|
00005040  82 bc db 47 00 00 00 00  82 bc db 47 00 00 00 00  |...G.......G....|
00005050  82 bc db 47 00 00 00 00  00 00 00 00 00 00 00 00  |...G............|
00005060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00005070  00 00 00 00 00 00 00 00  02 00 00 00 00 00 00 00  |................|
00005080  00 00 00 00 dd fb 08 00  00 00 00 00 00 00 00 00  |................|
00005090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000050f0  85 00 03 00 12 00 00 00  00 00 00 00 00 00 00 00  |................|
00005100  00 00 00 00 00 00 00 00  01 00 00 00 01 c0 02 00  |................|
00005110  00 00 00 00 02 00 00 00  01 00 00 00 00 20 00 00  |............. ..|
00005120  00 00 00 00 03 00 00 00  01 00 00 00 00 40 00 00  |.............@..|
00005130  00 00 00 00 04 00 00 00  01 00 00 00 00 60 00 00  |.............`..|
00005140  00 00 00 00 05 00 00 00  01 00 00 00 00 80 00 00  |................|
00005150  00 00 00 00 06 00 00 00  01 00 00 00 00 a0 00 00  |................|
00005160  00 00 00 00 07 00 00 00  01 00 00 00 00 c0 00 00  |................|
00005170  00 00 00 00 08 00 00 00  01 00 00 00 00 e0 00 00  |................|
00005180  00 00 00 00 09 00 00 00  01 00 00 00 00 00 01 00  |................|
00005190  00 00 00 00 0a 00 00 00  01 00 00 00 00 20 01 00  |............. ..|
000051a0  00 00 00 00 0b 00 00 00  01 00 00 00 00 40 01 00  |.............@..|
000051b0  00 00 00 00 0c 00 00 00  01 00 00 00 00 60 01 00  |.............`..|
000051c0  00 00 00 00 0d 00 00 00  01 00 00 00 00 80 01 00  |................|
000051d0  00 00 00 00 0e 00 00 00  01 00 00 00 00 a0 01 00  |................|
000051e0  00 00 00 00 0f 00 00 00  01 00 00 00 01 80 02 00  |................|
000051f0  00 00 00 00 10 00 00 00  01 00 00 00 00 a0 02 00  |................|
00005200  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00007000  4a 46 53 31 01 00 00 00  68 b8 3f 00 00 00 00 00  |JFS1....h.?.....|
00007010  00 10 00 00 0c 00 03 00  00 02 00 00 09 00 00 00  |................|
00007020  00 20 00 00 00 09 20 10  00 00 00 00 00 00 00 00  |. .... .........|
00007030  04 00 00 00 57 00 00 00  02 00 00 00 55 00 00 00  |....W.......U...|
00007040  06 08 00 00 ee 00 00 00  00 08 00 00 50 f7 07 00  |............P...|
00007050  43 00 00 00 0d f7 07 00  82 bc db 47 00 00 00 00  |C..........G....|
00007060  32 00 00 00 02 00 00 00  00 00 00 00 00 00 00 00  |2...............|
00007070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00007080  00 00 00 00 00 00 00 00  7b b5 df 89 3a 90 4c 92  |........{...:.L.|
00007090  8a a7 a9 42 71 80 60 87  00 00 00 00 00 00 00 00  |...Bq.`.........|
000070a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00008000
/Users/dav7/ +

I think I just did something cool. I'm not entirely sure what, but yeah... :D :D :D

Thanks!

-dav7

**Lostfarmer** · 09-07-2009

On the 'sda9ept' I made a typo error, it is "05" not "0f".

Another typo error or math:

So the next EPT for sda10 starts at sector 116647965+128520(first EPT location)=116776484

That should be 116647965+128520=116776485

Need to verify sector 116776485 for an EPT.

The last code display is good. It starts (header data) 64 sectors after the first sector of partition. We know where the lost partition (header data) is from your post #7 Sector 101787903. Now we have to make that the same location from start of lost partition.

There is no real way from me to verify. But every thing points for the lost partition is :

Code:

File type=83  Start sector=10178740 Total sector=14988643

Will try to recheck my math tomorrow, must log off now. Can use 'fdisk' to enter data.

Thread Tools

Display

Posting Permissions