Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Last revision Both sides next revision
testdisk [2012/04/09 16:42]
mike
testdisk [2012/04/10 15:04]
mike
Line 84: Line 84:
 while [ $i -lt 10000 ] while [ $i -lt 10000 ]
 do do
-        echo $i+        ​echo $i
  
         set -- "​$targetdir"/​*         set -- "​$targetdir"/​*
Line 128: Line 128:
 To corrupt the disk, I'm throwing random nulls throughout the image with the code below. To corrupt the disk, I'm throwing random nulls throughout the image with the code below.
  
-<​code>​ +<​code ​bash
-blacktower:​~/​testdisk# ​vi ./​corrupt.bash+blacktower:​~/​testdisk# ​cat ./​corrupt.bash
 #!/bin/bash #!/bin/bash
 i=0 i=0
 while [ $i -lt 100 ] while [ $i -lt 100 ]
-do  +do 
- target=$(( RANDOM % 5120 ))$(( RANDOM % 10000 )) + ​target=$(( RANDOM % 5120 ))$(( RANDOM % 10000 )) 
- echo $target + echo $target 
- dd if=/​dev/​zero of=./​baddisk.img bs=1 count=1 seek=$target 2> /dev/null + #dd if=/​dev/​zero of=./​baddisk.img bs=1 count=1 seek=$target 2> /dev/null 
-  i=$((i+1))+ ./corrupt ./​baddisk.img $target 
 +   i=$((i+1))
 done done
-blacktower:​~/​testdisk#​ ./corrupt.bash +</​code>​ 
-8528335 +<code c> 
-26272528 +blacktower:​~/​testdisk# ​cat ./corrupt.c 
-17838022 +#include <​stdio.h>​ 
-... +/* program to write to specific location of a file */ 
-7885613 + 
-12015832 +int main(int argc, char* argv[]) 
-20671949+
 + FILE* fh; 
 + 
 + if( argc != 3 ) { 
 +   ​printf( "​\nUsage:​ %s filename\n\n Where \"​filename\"​ is the file to corrupt and \"​location\"​ is the offset in bytes\n",​ argv[0] ); 
 +   ​return(1);​ 
 + } 
 + 
 + fh = fopen( argv[1], "​r+"​ ); 
 + 
 + if( fh == NULL ) { 
 +   ​printf( "​\nCould not open existing file for writing!\nUsage:​ %s filename\n\n Where \"​filename\"​ is the file to corrupt and \"​location\"​ is the offset in bytes\n",​ argv[0] ); 
 +   ​return(1);​ 
 + } 
 + 
 + ​fseek( fh, atoi(argv[2])-2,​ SEEK_SET ); 
 + 
 + ​fputc( 0, fh ); 
 + 
 + fclose( fh ); 
 + return 0; 
 +}
  
 </​code>​ </​code>​
  
-Success... corrupted ​filesystem.+<​code>​ 
 +blacktower:​~/​testdisk# ​./corrupt.bash 
 +blacktower:​~/​testdisk#​ mount -o loop ./​baddisk.img /​mnt/​baddisk/​ 
 +blacktower:​~/​testdisk#​ md5sum /​mnt/​baddisk/​* 2> /dev/null 
 +0b5080a051d53ba2432b666c90d7c0b4 ​ /​mnt/​baddisk/​fortunes.txt 
 +8f301122918ab70d8cdccebdac46c8c5 ​ /​mnt/​baddisk/​libreoffice writer.doc 
 +45f1fbff8dcd6a92eef33e5639837c81 ​ /​mnt/​baddisk/​libreoffice writer.odt 
 +6dbeeb8ff8b82d35296dfc5265897f92 ​ /​mnt/​baddisk/​libreoffice writer.pdf 
 +9d4cb7f894983e667a7c2173f9fa59c4 ​ /​mnt/​baddisk/​libreoffice writer.rtf 
 +24896c06121360c4b3daa1deca7e854f ​ /​mnt/​baddisk/​testimage.bmp 
 +3c90cdc73c1b155b7cdd5e0a13584207 ​ /​mnt/​baddisk/​testimage.jpg 
 +8b40c922b02ef43be7c986fa59536260 ​ /​mnt/​baddisk/​testimage.png 
 +blacktower:​~/​testdisk#​ 
 +</​code>​ 
 + 
 +Looks like we hit mostly empty space. ​ Only the bmp is corrupted. 
 + 
 +Change the 100 random bytes to 10000 and run again:
  
 <​code>​ <​code>​
 blacktower:​~/​testdisk#​ fsck.ext3 ./​baddisk.img blacktower:​~/​testdisk#​ fsck.ext3 ./​baddisk.img
 e2fsck 1.41.12 (17-May-2010) e2fsck 1.41.12 (17-May-2010)
-Superblock has an invalid journal (inode 8). +./​baddisk.img:​ clean, 20/12544 files, 7703/50000 blocks
-Clear<​y>?​ yes+
  
-*** ext3 journal has been deleted - filesystem is now ext2 only ***+blacktower:​~/​testdisk#​ md5sum /​mnt/​baddisk/​2> /dev/null 
 +e04f2a97d51432d04a64f642e350b1f0 ​ /​mnt/​baddisk/​fortunes.txt 
 +8f301122918ab70d8cdccebdac46c8c5 ​ /​mnt/​baddisk/​libreoffice writer.doc 
 +fc2475f7a1a70f2f31ae50ca59b96cb7 ​ /​mnt/​baddisk/​libreoffice writer.odt 
 +6037209ee8c78156a1e6acea00b09dd1 ​ /​mnt/​baddisk/​libreoffice writer.pdf 
 +16a93d89a8dedfd23ab629006104cbca ​ /​mnt/​baddisk/​libreoffice writer.rtf 
 +aaf2de72c3f2966bf414d598435dc432 ​ /​mnt/​baddisk/​testimage.bmp 
 +3c8a111a8c9baaa09aea73e7d59e890e ​ /​mnt/​baddisk/​testimage.jpg 
 +e3912ad720969f46308cdccad73a66f8 ​ /​mnt/​baddisk/​testimage.png 
 +</​code>​
  
-The filesystem size (according to the superblock) ​is 50000 blocks +Only the .doc file is safe now.  ​
-The physical size of the device is 20187 blocks +
-Either the superblock or the partition table is likely to be corrupt! +
-Abort<​y>?​ yes+
  
-blacktower:​~/​testdisk#​ mount -o loop ./​baddisk.img /​mnt/​baddisk/​ +Again.
-mount: wrong fs type, bad option, bad superblock on /​dev/​loop0,​ +
-       ​missing codepage or helper program, or other error +
-       In some cases useful info is found in syslog - try +
-       dmesg | tail  or so+
  
-blacktower:​~/​testdisk# ​dmesg | tail +<​code>​ 
-... +blacktower:​~/​testdisk# ​fsck.ext3 ./baddisk.img 
-[2097323.950735] EXT3-fs: no journal found. +e2fsck 1.41.12 (17-May-2010) 
-blacktower:​~/​testdisk#​ mount -o loop -t ext2 ./​baddisk.img /mnt/baddisk+./​baddisk.img: clean, 20/12544 files, 7703/50000 blocks 
-mountStale NFS file handle+blacktower:~/testdisk#
 </​code>​ </​code>​
 +
 +fortune.txt is visibly corrupted, and every file fails an MD5, but the filesystem hasn't reported any problems yet.
 +
 +{{:​article-testdisk:​corruption.png?​nolink&​300 |}}
 +
 +
 +
  
 === Running Testdisk === === Running Testdisk ===
Line 184: Line 231:
 Seems like a lost cause. ​ Even the size of the disk comes up wrong in the "​Geometry"​ menu of Testdisk Seems like a lost cause. ​ Even the size of the disk comes up wrong in the "​Geometry"​ menu of Testdisk
  
 +<​code>​
 Disk ./​baddisk.img - 20 MB / 19 MiB - CHS 3 255 63, sector size=512 Disk ./​baddisk.img - 20 MB / 19 MiB - CHS 3 255 63, sector size=512
  
Line 189: Line 237:
 If a disk listed above has incorrect size, check HD jumper settings, BIOS If a disk listed above has incorrect size, check HD jumper settings, BIOS
 detection, and install the latest OS patches and disk drivers."​ detection, and install the latest OS patches and disk drivers."​
 +</​code>​
 +