Return to BSD News archive
Path: euryale.cc.adfa.oz.au!newshost.anu.edu.au!harbinger.cc.monash.edu.au!news.rmit.EDU.AU!news.unimelb.EDU.AU!munnari.OZ.AU!spool.mu.edu!howland.reston.ans.net!newsfeed.internetmci.com!EU.net!Germany.EU.net!zib-berlin.de!news.tu-chemnitz.de!irz401!uriah.heep!not-for-mail From: j@uriah.heep.sax.de (J Wunsch) Newsgroups: comp.unix.bsd.freebsd.misc Subject: Re: Reconstructing Partition data. Date: 12 Nov 1995 14:23:40 +0100 Organization: Private FreeBSD site, Dresden. Lines: 31 Message-ID: <484sgs$jkb@uriah.heep.sax.de> References: <47n6di$gmf@mordred.gatech.edu> NNTP-Posting-Host: uriah.heep.sax.de Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit Eric <eric@wrekquest.ohr.gatech.edu> wrote: >I have a freebsd 2.0.5 system with a drive that went south. From >what I can tell the first sectors got hosed. I need to find a way >to figure out were the partions lie. I have in an intact state. I >was able to go through w/nortons disk edit and look at the data. It >appears to be ok. I just wondered if there were pattern I could look >for and find the boundries. Any help is appreciated. All I really >need back is the /home filesystem, the other data was backed up recently >enough. <sys/disklabel.h> says: #define DISKMAGIC ((u_long) 0x82564557) /* The disk magic number */ This is what you can see as the "WEV" string from a quick glance on the ASCII output of a disk dump. This allows to find the BSD label. If the BSD label is still intact, everything is fine for you. If the disk label is damaged, too, you have to look around for the partitions. <ufs/ffs/fs.h> explains us: #define FS_MAGIC 0x011954 /* the fast filesystem magic number */ #define FS_OKAY 0x7c269d38 /* superblock checksum */ Perhaps this should allow you locating the file system superblocks. (Don't be fooled: there are additional inside the file systems.) -- cheers, J"org joerg_wunsch@uriah.heep.sax.de -- http://www.sax.de/~joerg/ -- NIC: JW11-RIPE Never trust an operating system you don't have sources for. ;-)