hard disk crash

[Emiliano Brunetti]

On Wed, 2004-10-27 at 01:48, linux r wrote:
> On Tue, 26 Oct 2004 10:22:34 +0200, Emiliano Brunetti
> <emiliano.brunetti at fastwebnet.it> wrote:
> > Hi everybody.
> > 
> > I am running FC1 and one of my hdd crashed: i can't even mount it.
> > 
> > It is a reiser partition on a 70Gb SCSI disk. I tried with reiserfsck
> > --rebuild-tree -S /dev/sdc1 - after waiting for a long time, looked like
> > it had fixed something. However, i still can't mount the partition.
> > Mount reports some errors (sorry, can't be more specific right now, but
> > it is the usual error - unable to mount, bad superblock or too many
> > mounted file system...).
> > 
> > So i tried with reiserfsck --rebuild-sb /dev/sdc1, that didn't work.
> > 
> > So i tried with the scsi adapter utility and verified media. Looks like
> > some sectors are indeed damaged, and the verify utility claimed it was
> > able to flag them as corrupted and make the disk usable again.
> > 
> > It didn't work either.
> > 
> > Now, i'd like to save all that i can from that disk, and then i'd try to
> > format and see if i can recover it. However, i can't even mount it so i
> > really don't know what to do. I read somewhere that i could try to 'dd
> > if=/dev/sdc1 of=/dev/newparition', and also that it is supposed to work
> > even with unmounted partition. Anybody tried this out? ANy hints? I
> > wonder why i am not able to mount the partition if reiserfsck
> > --rebuild-sb says that the superblock is good.

> How much ram do you have on the box?  Reiser should be better than
> that, I am surprised.  

I am surprised as well. Not much ram, i guess around 356 or something
like this. The biggest surprise is that, even if i scan the drive with
the scsi host adapter utility, i can't mount. That utility is supposed
to mark as bad those clusters, isn't it? If they got marked, i should be
able to run reiserfsck and rebuild, at least, the superblock, and then
mount the drive. Am i wrong?

> One method would be to look at it forensically.
> 1.  Pretend your main one is the 'suspect' disk.  
> 
> 2.  Are you able to mount it from Knoppix or another distro?  Use
> knoppix to boot up and dd an entire copy of the drive (with this size
> it might take awhile but this is a sound method if you have the time
> for it to run).

I think so. The problem with dd is that i don't have enough room to copy
the whole partition. I'll try and get another disk as soon as possible.

> 3.  dd it to another removable device, preferably another (USB
> external) hard drive so that you don't run into weird geometry issues
> or other time consuming things.

USB is not an option unfortunately. That machine is too old, and usb far
too slooooooooow. 70 gigs would take approximately a couple of days. :(

> 4.  Now that you have another copy you can truly play around with
> other stuff.   It may be that you can recover more than you think
> because of the fact that you will be on a ramdrive and _some_ of the
> files  that may otherwise be lost, will <possibly> be in ram.  Maybe a
> bad sector on the disk only happenned to have a few files on that
> spot.  If that were the case, then you would be lucky and only maybe
> lose a small amount of data.

Yes, i think so. Just a few bad clusters, not yet the whole disk. Should
i keep running reiserfsck?

I never really used dd. After i copy the whole partition to another
hopefully healthy drive, can't i just zap everything away from the old
damaged drive and format it? I just wish i could save some of the data.

Is this correct?

> 5.  Try fsck and some of the same commands, now with the new drive and
> see what it does with the same files on the NEW drive.

Ok.

> 6.  Now that you  have two copies, you can run other tools, etc. 
> Maybe on the COPY you can play around with fdisk and get it bootable. 
> The way I would approach it would be to try to get as much as I can,
> even if it is only half of the data lets say it is a start.

Not a problem. That was not a boot disk. Just data.

Thanks a lot, will let you know.

E.