Re: [Staffslug] Hexedit - Recovery of ReiserFs

Hi, I am newby to Linux. The list of instructions I had included in my last email did not make sense at point 7 which is when I sent out the help request. Meantime, I continued reading some other stuff and found this: ------------------------------------------------------------------------------------------------ First, the drive obviously didn't have a standard PC partition table. # fdisk -l /dev/hdi Disk /dev/hdi: 300.0 GB, 300069052416 bytes 255 heads, 63 sectors/track, 36481 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes Disk /dev/hdi doesn't contain a valid partition table I should note that I tried testdisk at this point too, but it didn't find anything. Next, I checked for anything recognizable at the beginning of the disk. # dd if=/dev/hdi count=8 | strings Broadcom NAS Version 1.1 MBR Tag SYSTEM 8+0 records in 8+0 records out 4096 bytes (4.1 kB) copied, 0.00013262 s, 30.9 MB/s After a little Googling for "broadcom nas", "hp media vault", and a few other things, I figured out there was a reiserfs filesystem on the thing somewhere. (Note: As pointed out in the first comment to this post, there is some great technical documentation on this thing online. Rather than follow it, I chose to cheat and do this the (relatively) easy way.) Google found me this nice document describing the on-disk structure of reiserfs. That's how I figured out that I was looking for a magic string "ReIsEr2Fs" (or "ReIsErFs" for version 1, or "ReIsEr3Fs" for version 3, according to some other search results). I used hexedit to find the offset of the magic string by doing hexedit /dev/hdi, hitting tab, hitting /, then typing in ReIsEr. 2685A020 84 03 00 00 1E 00 00 00 00 00 00 00 00 10 CC 03 06 00 01 00 52 65 49 73 ....................ReIs 2685A038 45 72 32 46 73 00 00 00 03 00 00 00 05 00 B7 08 02 00 00 00 CC A3 00 00 Er2Fs................... In this case, the magic string was at hex location 2685A034, which means the beginning of the superblock was at 2685A000, or (decimal) 646291456 bytes. The beginning of the superblock is 64k bytes before that, so I set up a loop device there: # losetup -o $[ 646291456 - 65536 ] /dev/loop0 /dev/hdi # mkdir /mnt/tmp # mount -r -t reiserfs /dev/loop0 /mnt/tmp The files my customer needed were in /mnt/tmp/FileShare/. It dawned on me that they mean the start address of the string ReIsEr, eg NOT change it just cursor to the R of ReIsEr and note the address. Then convert to decimal, take away 64K (in Decimal) eg 65536 and setup the loop device. God knows what that is but I did it, then mounted the drive and hey presto all my stuff appeared in the /mnt/tmp/ folder. I was then able to copy the files over to a windows share. I used Suse 11 for this. I will have to check out this Loop Device and figure out what its for but I expect it a sort interface between the HDD and the OS. Hope this helps. Regards, Walter _______________________________________________ Staffslug mailing list Staffslug(a)staffslug.org.uk http://lists.staffslug.org.uk/mailman/listinfo/staffslug