I/O buffer error, info on ddrescue gpart and file carving?

English Applications
1

I know, it sounds bad, and it might be, but I have to TRY to recover my data. Long story short:

Has sata drive connected via usb adapter and shared via samba over lan where I then used it as a ‘media’ drive, it was very busy and then I went to unmount one day and it wouldn’t, so I disconnected it when my reboot attempt failed. This was bad, very bad I have learned, and I was stupid.

That said now it has buffer i/o errors and doesn’t properly mount. Either the drive is now failing, which I doubt even though ddrescue shows bad sectors, I think it has lost its partition table. The question is can it be recovered using gpart?

The first 3 or so attempts at getting it to mount it was actually showing the correct layout, and if I had taken the time to google the error I was getting before going any further, I would have made a copy of that layout, but I did not and do not have it now, and now it won’t show the layout. That brings me to the next question:

With a ddrescue image, how will I mount it or access the files if it has no partition table or layout of some kind. It is doing the backup now but ddrescue and everything else I have tried now only shows the device as sdb and no partitions.

Will I have to use file carving or something like scalpel to actually get the data from the image after it is saved? There are very few bad sectors shown when I run ddrescue or first boot and it tries to mount, and the sectors are at the beginning of the disc, I’m guessing that is why the partition table is corrupt or missing? I only think it is corrupt or missing because of how it WAS showing the first few times I tried to mount it initially after the errors started, it shows the correct layout and just wouldn’t mount. I should have made the image then but I didn’t do that either.

Any advice is sound, and any criticism is also taken to heart, I need it. I have been very hard on myself over the last 48 hours when this started, as I have music from the past 15 years on this drive. I should NOT have used my primary backup drive in the manner I did, and nor should you!

Gratz.

edit: a bit of info. The drives a 320gb sata 7200rpm, less than a year old, and had no smart errors or benchmark problems the last I ran them less than 2 weeks ago. I think it has 5 partitions on it. The very last one being 290gb’s exactly, 290 is what you would see in the Disk Utility in Gnome 3 for that partition, and I am almost positive it is the very last partition on the disk but I could be wrong. That partition is probably ext4. There may have been 1 ntfs but I doubt it. The rest were ext3/4 and a swap. The machine it was running on and shared over samba was running MInt 9, 32 bit. If I can get the log of the i/o buffer error I’ll post it following this.

2

Ok this is a hunk from dmesg on the drive SUSE Paste

and this is from /var/log/warn: SUSE Paste

3

I am simplifying.

Drives are not mounted. Filesytems are.
Filesystems are created by formatting a partition.
In 'nix everything iis a file .dd copies “raw” files. ddrescue is a version of dd that can skip over bad data.
Filesystem images can be mounted using the mount -o loop syntax.

When something goes wrong with a drive, ddrescue is used to make an image of the bad partition(s), or in exteremis the complete drive, on good media.
The damaged drive can then be physically disconnected, so as to prevent further damage.
A “work” copy of the rescue image is then made, and attempts are made to repair this with e.g.* fsck* sufficient to effect data recovery.
If this fails then another “work” copy of the image can be made to try again.
It seems perverse to make ddrescue images, and then work on the physical drive.

4

eng-int: Thank you. That was informative, and I am happy most of that is cleared up for someone that might not understand like me.

As far as working on the physical drive, what I meant was mounting the image that dd creates. Of course you mentioned how, but the question still has me baffled.

If I read what you said correctly, that means mounting the image of the drive which you might not consider ‘good media’ is pointless, since it has no partition table or it’s not seeing it?

I can and will TRY mounting the image or a copy of, but if it shows up the same way the drive is now, as an unformatted 320gb partition, what can I do next? Is that where I might try file carving? My first post may have been too drawn out, but I did mention that the first few times I tried accessing the drive it was showing the partitions, but now I can’t get it to. ls /dev also only shows /dev/sdb

This is what I see and what I assume ddrescue sees.
:
http://i.imgur.com/8uwAC.png

5

On 2012-01-17 05:36, l300lvl wrote:
>
> I know, it sounds bad, and it might be, but I have to TRY to recover my
> data. Long story short:

…

> Ok this is a hunk from dmesg on the drive ‘SUSE Paste’
> (http://susepaste.org/25480575)
>
> and this is from /var/log/warn: ‘SUSE Paste’
> (http://susepaste.org/53267751)

Before attempting any rescue, you have a bigger problem to solve first, and
is that your usb/box/disk combo is misbehaving. Look at the lines 1 to 33
of the message log. These errors are later causing the errors you see in
the filesystem. Do not attempt any rescue till you solve that first.

–
Cheers / Saludos,

Carlos E. R.
(from 11.4 x86_64 “Celadon” at Telcontar)

6

I can and will TRY mounting the image or

Wrong. You have to repair the image, and get usable filesystem(s) first. You cannot repair a mounted filesystem.

7

How do I repair the image? Should I try to build a partition table on the image, or scan for one?

EDIT: I see now you mentioned using fsck.

At the moment ddrescue is still running,and robin_listas: you are probably right, but I have no other way to connect the hd.

8

On 2012-01-18 17:56, l300lvl wrote:

> At the moment ddrescue is still running,and robin_listas: you are
> probably right, but I have no other way to connect the hd.

Then get a way.

It is useless to try repair the filesystem with broken hardware.

–
Cheers / Saludos,

Carlos E. R.
(from 11.4 x86_64 “Celadon” at Telcontar)

9

Understood. I have placed the drive in a secure location, and backed up the copy of the image it made anyways. So now I will try to get a better enclosure but my eBay is in hiatus so it may take a couple weeks or more, as I have no access to anything right now.

There is one other possibility:

What if I install it in another laptop I have, and run the backup drive that ddrescue will save the image to, from that usb device that is corrupt. It may be malfunctioning, but at least this way it would only be corrupting the image, and not the whole drive/file systems. Is that a better possibility?

If not I will just wait.

Gratz

10

I am not sure what is going on. If you have an image of the entire hard drive taken with ddrescue, and the image has a bad partition table, then you could try repairing a copy of the image with a program such as *gpart *, and then extract images of the filesystems. The filesystem images can be checked and repaired with e.g. fsck, before mounting and attempting data recovery.

If you do not yet have any drive or filesystem image files, and this is an external USB device, then the best course is probably to remove the drive from its USB adaptor and try connecting it directly to a PC. If you do not have access to a suitable computer running Linux, or Unix, then a Live CD or rescue boot may suffice.

It is difficult to be more specific without more information about what you are doing, and to what.

11

On 2012-01-19 04:26, l300lvl wrote:

> Understood. I have placed the drive in a secure location, and backed up
> the copy of the image it made anyways. So now I will try to get a better
> enclosure but my eBay is in hiatus so it may take a couple weeks or
> more, as I have no access to anything right now.

It may be as simple as reconnecting the cables. Inside and outside.

> There is one other possibility:
>
> What if I install it in another laptop I have, and run the backup drive
> that ddrescue will save the image to, from that usb device that is
> corrupt. It may be malfunctioning, but at least this way it would only
> be corrupting the image, and not the whole drive/file systems. Is that a
> better possibility?

as long as you do not attempt to mount the disk, it is Ok.

Yes, you can try plugging to another computer and see if there are no usb
errors there.

Or, take out the HD from the enclosure and connect it directly to a computer.

I do not know what exactly is broken, but the current combo is unusable.
Yes, you can try to repair what you extracted with dd, but what for? Keep
it, but try to make the combo work correctly first, and then obtain an
image, without those usb errors.

There is a cheap gadget that consists of a cable and a plug for the disk,
without box. That would be a way.

–
Cheers / Saludos,

Carlos E. R.
(from 11.4 x86_64 “Celadon” at Telcontar)

12

That cheap gadget is what I am currently using.

I will have to come up with enough to get something more quality, so for now I will try to get another machine up and running and plug it inside that internally, so it has a direct connection. Like you said, it could just work, but either way at least I will be able to get a better image that way.

Probably going to be a few days but I will post back eventually, the drive isn’t going anywhere and I have many others to use for now, just no way to really hook them up safely at the moment.

13

On 2012-01-20 05:26, l300lvl wrote:

> That cheap gadget is what I am currently using.

Oh! Too bad, then. :frowning:

> I will have to come up with enough to get something more quality, so
> for now I will try to get another machine up and running and plug it
> inside that internally, so it has a direct connection. Like you said, it
> could just work, but either way at least I will be able to get a better
> image that way.

Your machine is sATA or pATA? if sATA, you just need to get the cable out
and get an external sATA. It is what I use.

> Probably going to be a few days but I will post back eventually, the
> drive isn’t going anywhere and I have many others to use for now, just
> no way to really hook them up safely at the moment.

We will be waiting. Lets hope it works.

–
Cheers / Saludos,

Carlos E. R.
(from 11.4 x86_64 “Celadon” at Telcontar)