fsdb help needed urgently! Please!!

fsdb help needed urgently! Please!!

Post by David Wind » Mon, 02 Jun 2003 08:48:57



I'm not sure what happened exactly, but upon rebooting an HP-UX 11i
system (785/B2600) just now, the system is telling me that the HFS disk
located at /dev/rdsk/c2t5d0 cannot be mounted, because fsck is saying
it's not an HFS disk.  Running fsck manually, I'm told:
** /dev/rdsk/c2t5d0
BAD SUPER BLOCK: MAGIC NUMBER WRONG
USE -b OPTION TO FSCK TO SPECIFY LOCATION OF AN ALTERNATE
SUPER-BLOCK TO SUPPLY NEEDED INFORMATION; SEE fsck(1M)

Checking /var/adm/sbtab I find no listing for this disk.

The man page for fsck tells me an alternate superblock is usually
located at block 16, but fsck -b 16 -F hfs /dev/rdsk/c2t5d0 doesn't
work.

The disk in question contains ALL my local applications and users home
directories. (Yikes!)  Ironically, I shut the system down and rebooted
in order to add an external SCSI disk which I was planning to use for
backups (since I've been living dangerously until now, and have
apparently just paid the price!)  I have another ~identical system that
I use as a sort of mirror, but I only copy files (as a way of doing
backups) between the two manually (not many users, luckily).  Looking at
that system's /var/adm/sbtab file I find all the data for the
counterpart to the HFS disk in question, but those superblock numbers
don't work with fsck either.

I have a feeling that I may have screwed up this disk when I accidently
  overwrite some files in /etc a few days ago, in particular some of the
/etc/*tab files, which I had inadvertently copied from the counterpart
system. I really don't know what I'm talking about here, but I wonder if
overwriting mnttab and then shutting the system down just now somehow
did bad things to this HFS disk?

Anyway, from what I can tell the 'fsdb' program might be able to fix
things, but the man page warns that this is for experienced users (i.e.,
not me!)

So does anyone out there know how to fix this disk?  Please???

-David Windt

 
 
 

fsdb help needed urgently! Please!!

Post by all mail refus » Mon, 02 Jun 2003 06:18:41



>it's not an HFS disk.  Running fsck manually, I'm told:
>** /dev/rdsk/c2t5d0
>BAD SUPER BLOCK: MAGIC NUMBER WRONG
>USE -b OPTION TO FSCK TO SPECIFY LOCATION OF AN ALTERNATE
>SUPER-BLOCK TO SUPPLY NEEDED INFORMATION; SEE fsck(1M)

>Checking /var/adm/sbtab I find no listing for this disk.

>The man page for fsck tells me an alternate superblock is usually
>located at block 16, but fsck -b 16 -F hfs /dev/rdsk/c2t5d0 doesn't
>work.

Don't go rushing to your keyboard without checking this, but there
used to be a similar thing that could be seen on Sun disks (where
the usual -b-number was 32).

It might be that the block at 16 is spoiled but that there are multiple
others at intervals in the disk (made originally by the "newfs" command).
If that's the case and if you re-run "newfs" using the *no action* switch
which may be "-N" it may tell you what positions are in use and you can try
some of these beside "-b 16".

I suggest not using "fsdb" unless you know something about it - and the best
way to learn is to play on a working, disposable filesystem.

If you don't get any better ideas there's the rather painful route at
    http://www.porcupine.org/forensics/tct.html
    http://www.fish.com/tct/FAQ.html#delete
and you should try to protect the dodgy data until this is concluded one
way or another - perhaps backing it up to tape.

--

 
 
 

fsdb help needed urgently! Please!!

Post by David Wind » Mon, 02 Jun 2003 09:43:42



> It might be that the block at 16 is spoiled but that there are multiple
> others at intervals in the disk (made originally by the "newfs" command).
> If that's the case and if you re-run "newfs" using the *no action* switch
> which may be "-N" it may tell you what positions are in use and you can try
> some of these beside "-b 16".

I don't see any mention of a no-action switch in the newfs (or
newfs_hfs) man page.  Anyway, there's an identical (but working) version
of the bad disk on my 'mirror' system, and I believe the superblocks
listed in /var/adm/sbtab on that system should also work for the bad
disk.  But they don't.  I wonder if I somehow corrupted *all* the
superblocks, perhaps by overwriting mnttab (or some other /etc/*tab file)?

Quote:> I suggest not using "fsdb" unless you know something about it - and the best
> way to learn is to play on a working, disposable filesystem.

> If you don't get any better ideas there's the rather painful route at
>     http://www.porcupine.org/forensics/tct.html
>     http://www.fish.com/tct/FAQ.html#delete

Yes, it looks very painful indeed!  Is it even sane to consider
recovering a whole disk (~10GB) this way?

-David

 
 
 

fsdb help needed urgently! Please!!

Post by all mail refus » Mon, 02 Jun 2003 06:58:32



>I don't see any mention of a no-action switch in the newfs (or
>newfs_hfs) man page.

Googling the man pages leads me to think thats a HP-Sun difference.

Quote:>   Anyway, there's an identical (but working) version
>of the bad disk on my 'mirror' system, and I believe the superblocks

So what's your problem, just a busted disk and no lost data ?

Quote:>>     http://www.porcupine.org/forensics/tct.html
>>     http://www.fish.com/tct/FAQ.html#delete

>Yes, it looks very painful indeed!  Is it even sane to consider
>recovering a whole disk (~10GB) this way?

That's a cost-benefit decision that depends on your other options.

--

 
 
 

fsdb help needed urgently! Please!!

Post by do not repl » Mon, 02 Jun 2003 10:57:01


Quote:>>  Anyway, there's an identical (but working) version
>>of the bad disk on my 'mirror' system, and I believe the superblocks

> So what's your problem, just a busted disk and no lost data ?

No: the 'mirror' system isn't a real mirror - the file systems are
configured identically, but it's up to me to manually copy data between
the two.  So the bottom line is we've lost about a weeks worth of
experimental data from the lab (since that's the last time I did a
copy.)  Not the end of the world, but I'd like to recover from this if
possible.

Quote:>>>    http://www.porcupine.org/forensics/tct.html
>>>    http://www.fish.com/tct/FAQ.html#delete

>>Yes, it looks very painful indeed!  Is it even sane to consider
>>recovering a whole disk (~10GB) this way?

> That's a cost-benefit decision that depends on your other options.

I was really asking if this approach makes it possible to recover a disk
in it's entirety, rather than sorting through the recovered data to
extract each file separately.  (It seems to be just the latter, from
what I gather reading quickly through those webpages.)  And if not, then
would it be possible for an fsdb 'expert' to get the disk back up and
running?  I'd be willing to pay someone to do that if they could...

Do you think my suspicions about overwriting /etc/mnttab could explain
what happened?  The disk was working when I shut the system down, and it
was only upon reboot that the OS couldn't fsck the disk...

-David

 
 
 

fsdb help needed urgently! Please!!

Post by all mail refus » Mon, 02 Jun 2003 08:19:11



>No: the 'mirror' system isn't a real mirror - the file systems are
>configured identically, but it's up to me to manually copy data between
>the two.  So the bottom line is we've lost about a weeks worth of

Living with that loss may be your best answer; and using this event to
justify the backup system you're about to ask for.

Quote:>in it's entirety, rather than sorting through the recovered data to
>extract each file separately.  (It seems to be just the latter, from

I think it's only good for extracting each file separately, but you
could ask people who've actually used it for recovery (TCT mailing list?)
as I've only used it slightly to investigate computer misuse.

Quote:>Do you think my suspicions about overwriting /etc/mnttab could explain
>what happened?  The disk was working when I shut the system down, and it
>was only upon reboot that the OS couldn't fsck the disk...

I don't suspect that, or anything in particular.  Can you suggest why
other disks don't have the same problem ?

--

 
 
 

fsdb help needed urgently! Please!!

Post by do not repl » Mon, 02 Jun 2003 11:33:03


Quote:> Living with that loss may be your best answer; and using this event to
> justify the backup system you're about to ask for.

Right.  As I mentioned, the reason for the shutdown/reboot was to
install another disk, which I am planning to use for backups.  (There
are very few users on this system, and after years of dealing with tape
backups, I decided that backing up to another disk was the best solution
for me: if the first disk fails, the backup disk could just be mounted
in it's place...nice idea in theory, but today was a great example of
bad timing...)

Quote:> I don't suspect that, or anything in particular.  Can you suggest why
> other disks don't have the same problem ?

There's only one other disk, and that one's formated as an lvm.

I suppose I should confess that before the shutdown I did connect the
scsi cable to the new disk, i.e., without shutting down the system
first.  But the new disk is on an *external* scsi bus, whereas the
failed disk is on the internal scsi bus, so although I suppose it's
possible I just fried it by mishandling, I'd be surprised if that were
the case.  (The lvm disk is also on the internal scsi bus, by the way.)
  Would you concur?

-David

 
 
 

fsdb help needed urgently! Please!!

Post by all mail refus » Mon, 02 Jun 2003 08:48:40



>> Living with that loss may be your best answer; and using this event to
>> justify the backup system you're about to ask for.

>Right.  As I mentioned, the reason for the shutdown/reboot was to
>install another disk, which I am planning to use for backups.  (There
>are very few users on this system, and after years of dealing with tape
>backups, I decided that backing up to another disk was the best solution

Using as your sole backup further disks at the same site leaves you
vulnerable to common-cause losses such as fire and theft affecting
all of them.  Either removable media of some sort (I find tape satisfactory)
or a link to a remote site can't be sniffed at if the data's at all valuable.

Quote:>I suppose I should confess that before the shutdown I did connect the
>scsi cable to the new disk, i.e., without shutting down the system
>first.  But the new disk is on an *external* scsi bus, whereas the
>failed disk is on the internal scsi bus, so although I suppose it's

I'll wait for an expert lurker to have an opinion on that.

--

 
 
 

fsdb help needed urgently! Please!!

Post by do not repl » Mon, 02 Jun 2003 14:21:46


It turns out the problem was pretty easily solved (in case anyone was wondering.)

Remember I said I had accidently overwritten a bunch of files in /etc?

While, one of the files I overwrote was /etc/fstab.  Since it was
replaced with the fstab from my 'mirror' system, I assumed all was ok.
But it turns out that the disk in question had been formated as vxfs,
not hfs like on the mirror system.  So fsck tried to check the disk as
an hfs and failed.

Pretty dumb, eh?  Anyway, all is well again...

-David

 
 
 

fsdb help needed urgently! Please!!

Post by Rober » Mon, 02 Jun 2003 11:34:57


To determine if your disk as gone South you can try a dd command to
/dev/null or, if available, another disk.  That will tell you if your disk
is bad.  If it fails you have a problem with hardware.  Other wise, you may
be able to salvage the content on the disk.

dd if=/dev/rdsk/c2t5d0 of=/dev/null bs=1024

Quote:> I'm not sure what happened exactly, but upon rebooting an HP-UX 11i
> system (785/B2600) just now, the system is telling me that the HFS disk
> located at /dev/rdsk/c2t5d0 cannot be mounted, because fsck is saying
> it's not an HFS disk.  Running fsck manually, I'm told:
> ** /dev/rdsk/c2t5d0
> BAD SUPER BLOCK: MAGIC NUMBER WRONG
> USE -b OPTION TO FSCK TO SPECIFY LOCATION OF AN ALTERNATE
> SUPER-BLOCK TO SUPPLY NEEDED INFORMATION; SEE fsck(1M)

> Checking /var/adm/sbtab I find no listing for this disk.

> The man page for fsck tells me an alternate superblock is usually
> located at block 16, but fsck -b 16 -F hfs /dev/rdsk/c2t5d0 doesn't
> work.

> The disk in question contains ALL my local applications and users home
> directories. (Yikes!)  Ironically, I shut the system down and rebooted
> in order to add an external SCSI disk which I was planning to use for
> backups (since I've been living dangerously until now, and have
> apparently just paid the price!)  I have another ~identical system that
> I use as a sort of mirror, but I only copy files (as a way of doing
> backups) between the two manually (not many users, luckily).  Looking at
> that system's /var/adm/sbtab file I find all the data for the
> counterpart to the HFS disk in question, but those superblock numbers
> don't work with fsck either.

> I have a feeling that I may have screwed up this disk when I accidently
>   overwrite some files in /etc a few days ago, in particular some of the
> /etc/*tab files, which I had inadvertently copied from the counterpart
> system. I really don't know what I'm talking about here, but I wonder if
> overwriting mnttab and then shutting the system down just now somehow
> did bad things to this HFS disk?

> Anyway, from what I can tell the 'fsdb' program might be able to fix
> things, but the man page warns that this is for experienced users (i.e.,
> not me!)

> So does anyone out there know how to fix this disk?  Please???

> -David Windt

 
 
 

1. Help needed urgently for hard disk crash!!!

file:///C|/exceed/let.htm

[ let.htm 1K ]

Our HP C110 9000 Machine recently suffered a hard disk crash. The machine

has two hard disks, a system drive and a user space drive. We suspect

that we lost some boot information on the system disk - given that we have

not been able to boot the machine. We replaced the system drive with

another drive, installed the Operating System, and booted the machine, but

we failed to mount the user space drive - here's why (according to the

machine's diagnostics):

the user drive has an existing Logical Volume Manager (LVM) and

attempting to mount the drive will result in overwriting the

existing LVM and thus deem any other existing data on the drive

un-recoverable.

We would like to be able to recover the data of course, but we're at a

loss as to how to go about doing it!

If anyone can be of help, it would be greatly appreciated.

Regards,

Rodric

 

2. From Brian Van Tilborg

3. HELP !! AutoMap for SCSI drives urgently needed !!

4. Parity error system halted....help please

5. Needed urgently in UK- HP EISA Card

6. Windows Task Scheduler

7. needed urgently in uk

8. Persistent NDS errors

9. Please help - need to shutdown and unplug from Network

10. HP UX C5600 need help please

11. Please help, Directory list program needed.

12. Need Hardware Help! PLEASE!

13. need hp 9000 idiots guide for new job help please