Notes

Programs
Speedtouch Project
Snoopy Project
eciadsl Project
The bread recipe
Source Mage
BeOS
My resume
My blog
Notes
Donation

en fr

Partitions recovery with nbd

Benoît Papillault, 2004-09-28

Warning

This article describe a real case of damaged hard drive recovery. Even if I make the best effort when writing this article, you are solely responsible of the use your will make from it.

Problem description

After replacing the processor of one machine, I discovered that sector 0 of my IDE hard drive was broken. However, this sector used to contain the partition table. Hence, without this partition table, it was impossible to access the hard drive content. Several solutions have been considered:

Copy the hard drive on a larger hard drive:
This solution was not possible since I don't have a bigger or equal hard drive.
Using a partition recovery tool:
I use the testdisk tool written by Christophe GRENIER. This tool quickly found the lost partition table, but it was impossible to rewrite sector 0.
Putting the faulty hard drive in another machine:
The problem is identical since there is no mean (to my knowledge) to use partition under GNU/Linux is the sector 0 is bad. The problem is identical is we use another operating system.
Using loopback mount:
It is possible to use mount -o loop with an offset. This solution does not work for offsets larger than 2GB and no error messages are displayed.
Copy a partition on another hard drive:
Using the dd, it would have been possible to copy one partition to another hard drive and then to mount the file as loopback. This solution was not possible since we do not have enough disk space.

For those interested, here are the reference of the drive :

Commercial name: Maxtor® Diamond Max 9
Capacity : 200Go
Model    : 6Y200P0
FwRev    : YAR41BW0
SerialNo : Y62JFRVE
Manufactured date   : 29/01/2004 (written on the drive)
Purchasing date     : 04/05/2004 (written on GrosBill invoice)
End of warranty     : 25/05/2007 (as seen on Maxtor site)

Final solution

The final solution was to compute the start and end of each partition in byte by hand and to export this part of the drive as a

block
device

through the local network. This has been used to save and later to restore the data after a low level format of the drive.

Partition table recovery using testdisk

The machine was first started using an install CD of the Debian distribution, which offer a shell (Alt-F2). This shell has been used to mount another hard drive containing an operational GNU/Linux system and to chroot there. The machine had a network card properly configured and that has access to the Internet. This Internet access has been used to download a static version of the testdisk tool.

wget http://www.cgsecurity.org/testdisk-5.3.linuxstatic.tar.gz
tar zxvf testdisk-5.3.linuxstatic.tar.gz testdisk-5.3/linux
cd testdisk-5.3/linux
./testdisk_static /log /debug

Information displayed after selecting Analyze are:

     Partition                   Start          End       Size
 1   Linux                    0   1  1    32 254 63     530082
 2   Linux                   33   0  1    65 254 63     530145
 3   Linux                   66   0  1   588 254 63    8401995
 5   Linux                  589   1  1  6963 254 63  102414312
 6   Linux                 6964   1  1 13338 254 63  102414312
 7   Linux                13339   1  1 16708 254 63   54138987

Drive geometry is : 16709/255/63.

Computing start and size of each partition

In order to used nbd, we need to have the start of each partition, as well as the size of each partition in bytes. We need to convert available CHS information above. We have used gdb for that, without forgetting to convert to unsigned long long to make sure that computation were done on 64 bits integer. We take the partition 5 as an example here. It was a 50Go partition containing /home.

$ gdb
(gdb) p ((unsigned long long)589*255*63 + 1*63) * 512
$1 = 4844722176
(gdb) p (unsigned long long) 102414312 * 512
$2 = 52436127744

So, we have:

Start of the partition : 4844722176 octets
Size of the partition : 52436127744 octets

nbd patch

nbd was made up from there components:

nbd kernel module
nbd's client : nbd-client
nbd's server : nbd-server

Since we have a Debian distribution, the kernel module is already shipped and in order to install the other programs, we type:

apt-get install nbd-client nbd-server

However, this tool is not able to export part of a hard drive. Some modifications have been made to the nbd-server par. The source code has been downloaded by:

apt-get source nbd-server

and the following patch, written by myself, was applied to the 2.7.1 version : nbd.diff. This patch add a -o option used to specify the start of the file which will be exported. We really take care to carefully handle 64 bits integers (take care to not forget the --enable-lfs> for the Large File Support). Once the source code was patched, it has been download on the machine which has the faulty drive and compiled with:

./configure --enable-lfs --enable-syslog
make

Using nbd to save data

On the faulty machine (IP address : 192.168.1.2) :

nbd-server 2222 /dev/hda 52436127744 -o 4844722176

On the backup machine :

mknod /dev/nd0 b 43 0
nbd-client 192.168.1.2 2222 /dev/nd0
mkdir /mnt/falcon/hda5
mount /dev/nd0 /mnt/falcon/hda5
mkdir /home/falcon/hda5
cd /mnt/falcon/hda5
cp -Rpd . /home/falcon/hda5
umount /dev/nd0
nbd-client -d /dev/nd0

Low level formating of the drive

Since it was a Maxtor® drive, we use the tool available on their web site. It is the PowerMax version 4.09 tool and is available at Maxtor. We used the fast low level format with success. Checkings made with this tool lead to the following error code : deaca461.

Using nbd to restore data

We used the same commands as in the backup phase (after creating new partitions large enough to contain all the data) :

On the faulty machine (IP address : 192.168.1.2) :
```
nbd-server 2222 /dev/hda5
```

On the backup machine :

nbd-client 192.168.1.2 2222 /dev/nd0
mount /dev/nd0 /mnt/falcon/hda5
cd /home/falcon/hda5
cp -Rpd . /mnt/falcon/hda5
umount /dev/nd0
nbd-client -d /dev/nd0

Restoring grub

Since the /boot partition was on /dev/hda2, we run grub with the following commands :

$ grub
grub> root (hd0,1)
 Filesystem type is ext2fs, partition type 0x83

grub> setup (hd0)
 Checking if "/boot/grub/stage1" exists... no
 Checking if "/grub/stage1" exists... yes
 Checking if "/grub/stage2" exists... yes
 Checking if "/grub/e2fs_stage1_5" exists... yes
 Running "embed /grub/e2fs_stage1_5 (hd0)"...  16 sectors are embedded.
succeeded
 Running "install /grub/stage1 (hd0) (hd0)1+16 p (hd0,1)/grub/stage2 /grub/menu
.lst"... succeeded
Done.

grub> quit

Legal

Maxtor® is a registered trademark of Maxtor Corporation.

Benoît Papillault