[ale] Finding filesystems on a disk
Mark R. Lindsey
mark at vielle.datasys.net
Fri Jan 9 19:56:54 EST 1998
Howdy, all you filesystem fans. I'd appreciate your thoughts.
I recently witnessed the corruption of the partition table on a hard
drive. I know that, in general, it looked like this:
hda1 Empty No file system
hda2 Linux root ext2
hda3 Linux swap Linux swap
hda4 Extended Partition
hda5 Linux /usr ext2
hda6 Linux /var ext2
hda is about 2 gig. I believe that Linux was originally installed using
the default settings for the drive in the BIOS, including LBA. I need to
rebuild that partition table enough to find those filesystems.
I wrote a script to make a partition between N and the end of the drive
(logical cylinder 1023), then attempt to mount a ext2 filesystem on that
partition, read only. I was fortunate that the write, sync, and ioctl()
lets the kernel reread the partition table properly, and I found one
of those filesystems using that method.
However, it found only one, and I'm wondering what other ways I could try
to find the filesystems that are still on there. My two ideas are as follows:
- Write a scanner that'd read through hda looking for the signature of
ext2 filesystems (is this possible logically?)
- Maybe the drive wasn't originally LBA, and it just happened that one
of the partitions started on an LBA-addressable cylinder. The data on
that partition was fine, and easily readable -- is it possible that
using LBA you could mount a partition whose data wasn't made using LBA?
It's possible that I didn't properly implement the idea of scanning for
filesystems using fdisk and mount -- your thoughts there would be helpful.
More information about the Ale