Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
testdisk [2012/04/10 15:04]
mike
testdisk [2012/04/10 15:46]
mike
Line 218: Line 218:
 </​code>​ </​code>​
  
-fortune.txt is visibly corrupted, and every file fails an MD5, but the filesystem hasn't reported any problems yet.+fortunes.txt is visibly corrupted, and every file fails an MD5, but the filesystem hasn't reported any problems yet.
  
 {{:​article-testdisk:​corruption.png?​nolink&​300 |}} {{:​article-testdisk:​corruption.png?​nolink&​300 |}}
  
 +Different method:
  
 +blacktower:​~/​testdisk#​ tail -n +10 ./​baddisk-2.img > baddisk-2b.img
 +blacktower:​~/​testdisk#​ ls -l
 +total 299852
 +-rw-r--r-- 1 root root 50674559 Apr 10 18:10 baddisk-2b.img
 +-rw-r--r-- 1 root root 51200000 Apr  6 21:45 baddisk-2.img
  
 +blacktower:​~/​testdisk#​ mount -o loop ./​baddisk-2b.img /​mnt/​baddisk/​
 +mount: you must specify the filesystem type
 +blacktower:​~/​testdisk#​ mount -t ext3 -o loop ./​baddisk-2b.img /​mnt/​baddisk/​
 +mount: wrong fs type, bad option, bad superblock on /dev/loop0,
 +       ​missing codepage or helper program, or other error
 +       In some cases useful info is found in syslog - try
 +       dmesg | tail  or so
  
-=== Running Testdisk ===+blacktower:​~/​testdisk#​ fsck.ext3 ./​baddisk-2b.img 
 +e2fsck 1.41.12 (17-May-2010) 
 +fsck.ext3: Superblock invalid, trying backup blocks... 
 +fsck.ext3: Bad magic number in super-block while trying to open ./​baddisk-2b.img
  
-blacktower:~/testdisk# testdisk ./​baddisk.img+The superblock could not be read or does not describe a correct ext2 
 +filesystem. ​ If the device is valid and it really contains an ext2 
 +filesystem (and not swap or ufs or something else), then the superblock 
 +is corrupt, and you might try running e2fsck with an alternate superblock: 
 +    e2fsck -b 8193 <​device>​
  
-Seems like a lost cause Even the size of the disk comes up wrong in the "​Geometry"​ menu of Testdisk+blacktower:​~/​testdisk#​ fsck.ext3 -b 8193 ./​baddisk-2b.img 
 +e2fsck 1.41.12 (17-May-2010) 
 +fsck.ext3: Attempt to read block from filesystem resulted ​in short read while trying to open ./​baddisk-2b.img 
 +Could this be a zero-length partition?​ 
 +blacktower:​~/​testdisk#​ ls -l ./​baddisk-2b.img 
 +-rw-r--r-- 1 root root 50674559 Apr 10 18:10 ./​baddisk-2b.img 
 +blacktower:​~/​testdisk#​
  
-<​code>​ 
-Disk ./​baddisk.img - 20 MB / 19 MiB - CHS 3 255 63, sector size=512 
  
-"Note: Disk capacity must be correctly detected for a successful recovery. +The partition table is missing ​and the offsets for the backups are all messed up.
-If a disk listed above has incorrect size, check HD jumper settings, BIOS +
-detection, ​and install ​the latest OS patches and disk drivers.+
-</​code>​+
  
  
 +=== Testdisk ===
  
  
 +non-partitioned
  
  
 +=== photorec ==
 +
 +PhotoRec 6.11, Data Recovery Utility, April 2009
 +Christophe GRENIER <​grenier@cgsecurity.org>​
 +http://​www.cgsecurity.org
 +
 +Disk ./​baddisk-2b.img - 50 MB / 48 MiB (RO)
 +     ​Partition ​                 Start        End    Size in sectors
 +   P Unknown ​                 0   ​0 ​ 1     ​6 ​ 41  1      98974
 +
 +
 +14 files saved in /​root/​testdisk/​recup_dir directory.
 +Recovery completed.
 +txt: 14 recovered
 +
 +blacktower:​~/​testdisk/​recup_dir.3#​ head -1 *.txt
 +==> f0000000.txt <==
 +Just to have it is enough.
 +
 +==> f0000128.txt <==
 +men proud.
 +
 +==> f0003072.txt <==
 +
 +
 +==> f0004352.txt <==
 +it classified?
 +
 +==> f0004480.txt <==
 +rail2\hyphmax0}\aspalpha\ltrpar\langfe255\lang255\cf0\kerning1\hich\af3\dbch\af4\afs24\lang255\loch\f0\fs24{\rtlch \ltrch\loch
 +
 +==> f0006400.txt <==
 +wiss\fprq2\fcharset0 Arial;​}{\f3\fnil\fprq2\fcharset0 Andale Sans UI{\*\falt Arial Unicode MS};​}{\f4\fnil\fprq2\fcharset0 Tahoma;​}{\f5\fnil\fprq0\fcharset0 Tahoma;}}
 +
 +==> f0007552.txt <==
 +us.
 +
 +==> f0014848.txt <==
 +ker is a fellow who lends you his umbrella when the sun is shining
 +
 +==> f0017024.txt <==
 +ought, and the wisdom never to use either.
 +
 +==> f0017280.txt <==
 +owntown Newark is in your future.
 +
 +==> f0017664.txt <==
 +outh gets trashed.
 +
 +==> f0078080.txt <==
 +e
 +
 +==> f0095488.txt <==
 +amenco dancer'​s
 +
 +==> f0095616.txt <==
 + up to his neck in sand?
 +blacktower:​~/​testdisk/​recup_dir.3#​
 +
 +
 +=== Try harder ===
 +
 +Paranoid : Yes (Brute force enabled)
 +14 files
 +
 +
 +=== Expert Mode ===
 +
 +79 files saved in /​root/​testdisk/​recup_dir directory.
 +Recovery completed.
 +txt: 79 recovered
 +
 +
 +Unless we find the superblock, it looks like the fragmentation of the files is going to make it nearly impossible to find any files.
 +
 +We could create a signature to find the superblock... hmmm... ​
 +
 +http://​www.virtualblueness.net/​Ext2fs-overview/​Ext2fs-overview-0.1-12.html
  
 === Additional Information === === Additional Information ===