Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
testdisk [2012/04/10 15:04]
mike 		testdisk [2012/04/10 15:46] (current)
mike
Line 218: Line 218:
 </code> </code>
  
-fortune.txt is visibly corrupted, and every file fails an MD5, but the filesystem hasn't reported any problems yet.+fortunes.txt is visibly corrupted, and every file fails an MD5, but the filesystem hasn't reported any problems yet.
  
 {{:article-testdisk:corruption.png?nolink&300 |}} {{:article-testdisk:corruption.png?nolink&300 |}}
  
 +Different method:
  
 +blacktower:~/testdisk# tail -n +10 ./baddisk-2.img > baddisk-2b.img
 +blacktower:~/testdisk# ls -l
 +total 299852
 +-rw-r--r-- 1 root root 50674559 Apr 10 18:10 baddisk-2b.img
 +-rw-r--r-- 1 root root 51200000 Apr  6 21:45 baddisk-2.img
  
 +blacktower:~/testdisk# mount -o loop ./baddisk-2b.img /mnt/baddisk/
 +mount: you must specify the filesystem type
 +blacktower:~/testdisk# mount -t ext3 -o loop ./baddisk-2b.img /mnt/baddisk/
 +mount: wrong fs type, bad option, bad superblock on /dev/loop0,
 +       missing codepage or helper program, or other error
 +       In some cases useful info is found in syslog - try
 +       dmesg | tail  or so
  
-=== Running Testdisk ===+blacktower:~/testdisk# fsck.ext3 ./baddisk-2b.img 
 +e2fsck 1.41.12 (17-May-2010) 
 +fsck.ext3: Superblock invalid, trying backup blocks... 
 +fsck.ext3: Bad magic number in super-block while trying to open ./baddisk-2b.img
  
-blacktower:~/testdisk# testdisk ./baddisk.img+The superblock could not be read or does not describe a correct ext2 
 +filesystem.  If the device is valid and it really contains an ext2 
 +filesystem (and not swap or ufs or something else), then the superblock 
 +is corrupt, and you might try running e2fsck with an alternate superblock: 
 +    e2fsck -b 8193 <device>
  
-Seems like a lost cause.  Even the size of the disk comes up wrong in the "Geometry" menu of Testdisk+blacktower:~/testdisk# fsck.ext3 -b 8193 ./baddisk-2b.img 
 +e2fsck 1.41.12 (17-May-2010) 
 +fsck.ext3: Attempt to read block from filesystem resulted in short read while trying to open ./baddisk-2b.img 
 +Could this be a zero-length partition? 
 +blacktower:~/testdisk# ls -l ./baddisk-2b.img 
 +-rw-r--r-- 1 root root 50674559 Apr 10 18:10 ./baddisk-2b.img 
 +blacktower:~/testdisk#
  
-<code> 
-Disk ./baddisk.img - 20 MB / 19 MiB - CHS 3 255 63, sector size=512 
  
-"Note: Disk capacity must be correctly detected for a successful recovery. +The partition table is missing and the offsets for the backups are all messed up.
-If a disk listed above has incorrect size, check HD jumper settings, BIOS +
-detection, and install the latest OS patches and disk drivers." +
-</code>+
  
  
 +=== Testdisk ===
  
  
 +non-partitioned
  
  
 +=== photorec ==
 +
 +PhotoRec 6.11, Data Recovery Utility, April 2009
 +Christophe GRENIER <grenier@cgsecurity.org>
 +http://www.cgsecurity.org
 +
 +Disk ./baddisk-2b.img - 50 MB / 48 MiB (RO)
 +     Partition                  Start        End    Size in sectors
 +   P Unknown                  0   0  1     6  41  1      98974
 +
 +
 +14 files saved in /root/testdisk/recup_dir directory.
 +Recovery completed.
 +txt: 14 recovered
 +
 +blacktower:~/testdisk/recup_dir.3# head -1 *.txt
 +==> f0000000.txt <==
 +Just to have it is enough.
 +
 +==> f0000128.txt <==
 +men proud.
 +
 +==> f0003072.txt <==
 +
 +
 +==> f0004352.txt <==
 +it classified?
 +
 +==> f0004480.txt <==
 +rail2\hyphmax0}\aspalpha\ltrpar\langfe255\lang255\cf0\kerning1\hich\af3\dbch\af4\afs24\lang255\loch\f0\fs24{\rtlch \ltrch\loch
 +
 +==> f0006400.txt <==
 +wiss\fprq2\fcharset0 Arial;}{\f3\fnil\fprq2\fcharset0 Andale Sans UI{\*\falt Arial Unicode MS};}{\f4\fnil\fprq2\fcharset0 Tahoma;}{\f5\fnil\fprq0\fcharset0 Tahoma;}}
 +
 +==> f0007552.txt <==
 +us.
 +
 +==> f0014848.txt <==
 +ker is a fellow who lends you his umbrella when the sun is shining
 +
 +==> f0017024.txt <==
 +ought, and the wisdom never to use either.
 +
 +==> f0017280.txt <==
 +owntown Newark is in your future.
 +
 +==> f0017664.txt <==
 +outh gets trashed.
 +
 +==> f0078080.txt <==
 +e
 +
 +==> f0095488.txt <==
 +amenco dancer's
 +
 +==> f0095616.txt <==
 + up to his neck in sand?
 +blacktower:~/testdisk/recup_dir.3#
 +
 +
 +=== Try harder ===
 +
 +Paranoid : Yes (Brute force enabled)
 +14 files
 +
 +
 +=== Expert Mode ===
 +
 +79 files saved in /root/testdisk/recup_dir directory.
 +Recovery completed.
 +txt: 79 recovered
 +
 +
 +Unless we find the superblock, it looks like the fragmentation of the files is going to make it nearly impossible to find any files.
 +
 +We could create a signature to find the superblock... hmmm... 
 +
 +http://www.virtualblueness.net/Ext2fs-overview/Ext2fs-overview-0.1-12.html
  
 === Additional Information === === Additional Information ===