Page 1 of 2 12 LastLast
Results 1 to 10 of 13

Thread: I/O buffer error, info on ddrescue gpart and file carving?

  1. #1

    Default I/O buffer error, info on ddrescue gpart and file carving?

    I know, it sounds bad, and it might be, but I have to TRY to recover my data. Long story short:

    Has sata drive connected via usb adapter and shared via samba over lan where I then used it as a 'media' drive, it was very busy and then I went to unmount one day and it wouldn't, so I disconnected it when my reboot attempt failed. This was bad, very bad I have learned, and I was stupid.

    That said now it has buffer i/o errors and doesn't properly mount. Either the drive is now failing, which I doubt even though ddrescue shows bad sectors, I think it has lost its partition table. The question is can it be recovered using gpart?

    The first 3 or so attempts at getting it to mount it was actually showing the correct layout, and if I had taken the time to google the error I was getting before going any further, I would have made a copy of that layout, but I did not and do not have it now, and now it won't show the layout. That brings me to the next question:

    With a ddrescue image, how will I mount it or access the files if it has no partition table or layout of some kind. It is doing the backup now but ddrescue and everything else I have tried now only shows the device as sdb and no partitions.

    Will I have to use file carving or something like scalpel to actually get the data from the image after it is saved? There are very few bad sectors shown when I run ddrescue or first boot and it tries to mount, and the sectors are at the beginning of the disc, I'm guessing that is why the partition table is corrupt or missing? I only think it is corrupt or missing because of how it WAS showing the first few times I tried to mount it initially after the errors started, it shows the correct layout and just wouldn't mount. I should have made the image then but I didn't do that either.

    Any advice is sound, and any criticism is also taken to heart, I need it. I have been very hard on myself over the last 48 hours when this started, as I have music from the past 15 years on this drive. I should NOT have used my primary backup drive in the manner I did, and nor should you!

    Gratz.

    edit: a bit of info. The drives a 320gb sata 7200rpm, less than a year old, and had no smart errors or benchmark problems the last I ran them less than 2 weeks ago. I think it has 5 partitions on it. The very last one being 290gb's exactly, 290 is what you would see in the Disk Utility in Gnome 3 for that partition, and I am almost positive it is the very last partition on the disk but I could be wrong. That partition is probably ext4. There may have been 1 ntfs but I doubt it. The rest were ext3/4 and a swap. The machine it was running on and shared over samba was running MInt 9, 32 bit. If I can get the log of the i/o buffer error I'll post it following this.

  2. #2

    Default Re: I/O buffer error, info on ddrescue gpart and file carving?

    Ok this is a hunk from dmesg on the drive SUSE Paste

    and this is from /var/log/warn: SUSE Paste

  3. #3
    Join Date
    Oct 2008
    Location
    Glasgow, Scotland
    Posts
    1,131

    Default Re: I/O buffer error, info on ddrescue gpart and file carving?

    I am simplifying.

    Drives are not mounted. Filesytems are.
    Filesystems are created by formatting a partition.
    In 'nix everything iis a file .dd copies "raw" files. ddrescue is a version of dd that can skip over bad data.
    Filesystem images can be mounted using the mount -o loop syntax.

    When something goes wrong with a drive, ddrescue is used to make an image of the bad partition(s), or in exteremis the complete drive, on good media.
    The damaged drive can then be physically disconnected, so as to prevent further damage.
    A "work" copy of the rescue image is then made, and attempts are made to repair this with e.g. fsck sufficient to effect data recovery.
    If this fails then another "work" copy of the image can be made to try again.
    It seems perverse to make ddrescue images, and then work on the physical drive.

  4. #4

    Default Re: I/O buffer error, info on ddrescue gpart and file carving?

    eng-int: Thank you. That was informative, and I am happy most of that is cleared up for someone that might not understand like me.

    As far as working on the physical drive, what I meant was mounting the image that dd creates. Of course you mentioned how, but the question still has me baffled.

    If I read what you said correctly, that means mounting the image of the drive which you might not consider 'good media' is pointless, since it has no partition table or it's not seeing it?

    I can and will TRY mounting the image or a copy of, but if it shows up the same way the drive is now, as an unformatted 320gb partition, what can I do next? Is that where I might try file carving? My first post may have been too drawn out, but I did mention that the first few times I tried accessing the drive it was showing the partitions, but now I can't get it to. ls /dev also only shows /dev/sdb

    This is what I see and what I assume ddrescue sees.
    :

  5. #5
    Join Date
    Feb 2009
    Location
    Spain
    Posts
    25,547

    Default Re: I/O buffer error, info on ddrescue gpart and file carving?

    On 2012-01-17 05:36, l300lvl wrote:
    >
    > I know, it sounds bad, and it might be, but I have to TRY to recover my
    > data. Long story short:


    ....

    > Ok this is a hunk from dmesg on the drive 'SUSE Paste'
    > (http://susepaste.org/25480575)
    >
    > and this is from /var/log/warn: 'SUSE Paste'
    > (http://susepaste.org/53267751)


    Before attempting any rescue, you have a bigger problem to solve first, and
    is that your usb/box/disk combo is misbehaving. Look at the lines 1 to 33
    of the message log. These errors are later causing the errors you see in
    the filesystem. Do not attempt any rescue till you solve that first.

    --
    Cheers / Saludos,

    Carlos E. R.
    (from 11.4 x86_64 "Celadon" at Telcontar)

  6. #6
    Join Date
    Oct 2008
    Location
    Glasgow, Scotland
    Posts
    1,131

    Default Re: I/O buffer error, info on ddrescue gpart and file carving?

    I can and will TRY mounting the image or
    Wrong. You have to repair the image, and get usable filesystem(s) first. You cannot repair a mounted filesystem.

  7. #7

    Default Re: I/O buffer error, info on ddrescue gpart and file carving?

    Quote Originally Posted by eng-int View Post
    Wrong. You have to repair the image, and get usable filesystem(s) first. You cannot repair a mounted filesystem.
    How do I repair the image? Should I try to build a partition table on the image, or scan for one?

    EDIT: I see now you mentioned using fsck.

    At the moment ddrescue is still running,and robin_listas: you are probably right, but I have no other way to connect the hd.

  8. #8
    Join Date
    Feb 2009
    Location
    Spain
    Posts
    25,547

    Default Re: I/O buffer error, info on ddrescue gpart and file carving?

    On 2012-01-18 17:56, l300lvl wrote:

    > At the moment ddrescue is still running,and robin_listas: you are
    > probably right, but I have no other way to connect the hd.


    Then get a way.

    It is useless to try repair the filesystem with broken hardware.

    --
    Cheers / Saludos,

    Carlos E. R.
    (from 11.4 x86_64 "Celadon" at Telcontar)

  9. #9

    Default Re: I/O buffer error, info on ddrescue gpart and file carving?

    Quote Originally Posted by robin_listas View Post
    On 2012-01-18 17:56, l300lvl wrote:

    > At the moment ddrescue is still running,and robin_listas: you are
    > probably right, but I have no other way to connect the hd.


    Then get a way.

    It is useless to try repair the filesystem with broken hardware.

    --
    Cheers / Saludos,

    Carlos E. R.
    (from 11.4 x86_64 "Celadon" at Telcontar)

    Understood. I have placed the drive in a secure location, and backed up the copy of the image it made anyways. So now I will try to get a better enclosure but my eBay is in hiatus so it may take a couple weeks or more, as I have no access to anything right now.

    There is one other possibility:

    What if I install it in another laptop I have, and run the backup drive that ddrescue will save the image to, from that usb device that is corrupt. It may be malfunctioning, but at least this way it would only be corrupting the image, and not the whole drive/file systems. Is that a better possibility?

    If not I will just wait.

    Gratz

  10. #10
    Join Date
    Oct 2008
    Location
    Glasgow, Scotland
    Posts
    1,131

    Default Re: I/O buffer error, info on ddrescue gpart and file carving?

    I am not sure what is going on. If you have an image of the entire hard drive taken with ddrescue, and the image has a bad partition table, then you could try repairing a copy of the image with a program such as gpart , and then extract images of the filesystems. The filesystem images can be checked and repaired with e.g. fsck, before mounting and attempting data recovery.

    If you do not yet have any drive or filesystem image files, and this is an external USB device, then the best course is probably to remove the drive from its USB adaptor and try connecting it directly to a PC. If you do not have access to a suitable computer running Linux, or Unix, then a Live CD or rescue boot may suffice.

    It is difficult to be more specific without more information about what you are doing, and to what.

Page 1 of 2 12 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •