2009/5/29 Walt <walt(a)helvatron.co.uk>:
I am newby to Linux. The list of instructions I had included in my last
email did not make sense at point 7 which is when I sent out the help
request. Meantime, I continued reading some other stuff and found this:
First, the drive obviously didn't have a standard PC partition table.
# fdisk -l /dev/hdi
Disk /dev/hdi: 300.0 GB, 300069052416 bytes
255 heads, 63 sectors/track, 36481 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk /dev/hdi doesn't contain a valid partition
I should note that I tried testdisk at this point too, but it didn't find
anything. Next, I checked for anything recognizable at the beginning
of the disk.
# dd if=/dev/hdi count=8 | strings
Broadcom NAS Version 1.1 MBR Tag
8+0 records in
8+0 records out
4096 bytes (4.1 kB) copied, 0.00013262 s, 30.9 MB/s
After a little Googling for "broadcom nas", "hp media vault", and a
few other things, I figured out there was a reiserfs filesystem on the
thing somewhere. (Note: As pointed out in the first comment to this
post, there is some great technical documentation on this thing
online. Rather than follow it, I chose to cheat and do this the
(relatively) easy way.) Google found me this nice document
describing the on-disk structure of reiserfs. That's how I figured out
that I was looking for a magic string "ReIsEr2Fs" (or "ReIsErFs" for
version 1, or "ReIsEr3Fs" for version 3, according to some other
search results). I used hexedit to find the offset of the magic string by
doing hexedit /dev/hdi, hitting tab, hitting /, then typing in ReIsEr.
2685A020 84 03 00 00 1E 00 00 00 00 00 00 00 00 10 CC 03 06 00 01 00
52 65 49 73 ....................ReIs
2685A038 45 72 32 46 73 00 00 00 03 00 00 00 05 00 B7 08 02 00 00 00
CC A3 00 00 Er2Fs...................
In this case, the magic string was at hex location 2685A034, which
means the beginning of the superblock was at 2685A000, or
(decimal) 646291456 bytes. The beginning of the superblock is 64k
bytes before that, so I set up a loop device there:
# losetup -o $[ 646291456 -
65536 ] /dev/loop0 /dev/hdi
# mkdir /mnt/tmp
# mount -r -t reiserfs /dev/loop0 /mnt/tmp
The files my customer needed were in /mnt/tmp/FileShare/.
It dawned on me that they mean the start address of the string ReIsEr, eg
NOT change it just cursor to the R of ReIsEr and note the address. Then
convert to decimal, take away 64K (in Decimal) eg 65536 and setup the loop
device. God knows what that is but I did it, then mounted the drive and hey
presto all my stuff appeared in the /mnt/tmp/ folder. I was then able to
copy the files over to a windows share.
I used Suse 11 for this. I will have to check out this Loop Device and
figure out what its for but I expect it a sort interface between the HDD and
Hope this helps.
Crikey!!! And you claim to be new to Linux? You are obviously not new
to computer science though ;-) Well done on the detective work there.
It's been nearly two decades since I did any mathematical work
converting hex to decimal or even to binary and it makes my head hurt
now to even look at it :-)
I suspect that what HP have done is to somehow implement there own FAT
system perhaps? Creative do the same with their media players and I'm
actually glad they do because I accidentally wiped one once. Except I
hadn't because of this Creative filing system.
Linux user #373362