4

I have a Seagate 1TB Drive [ST1000LM010-9YH146] which had one FreeBSD slice and was formatted as UFS and mounted at /home on a pfsense box.

While changing some hardware around, the drive was inadvertently was plugged into a FreeAgent GoFlex cable (which has firmware) and plugged into a Win 7 laptop. When I went to setup a new pfsense box, it wouldn't mount and had an NTFS partition overlapping the UFS partition. Also, it was never used as a boot drive, just a temporary place for /home while I moved some files around.

There are some irreplaceable stuff on this drive and I'd like to be able to mount it to recover the files. I know enough to partition, mount and unmount, but don't trust myself to screw with the geometry without guidance.

From the testdisk log:

Disk /dev/ad6 - 1000 GB / 931 GiB - CHS 1938021 16 63
Analyse cylinder 1938021/1938020: 100%
Read error at 1938020/1/1 (lba=1953524223)

  No partition             0   0 35 1938020  15 29 1953525100 [/seagate-1tb]
Warning: Incorrect number of heads/cylinder 255 (NTFS) != 16 (HD)
  HPFS - NTFS              0   1  1 1938015  15 63 1953520065 [FreeAgent GoFlex Drive]

Disk /dev/ad6 - 1000 GB / 931 GiB - CHS 1938021 16 63

Warning: the current number of heads per cylinder is 16 but the correct value may be 128.
You can use the Geometry menu to change this value.
It's something to try if
- some partitions are not found by TestDisk
- or the partition table can not be written because partitions overlaps.


Disk /dev/ad6 - 1000 GB / 931 GiB - CHS 1938021 16 63
Analyse cylinder 1938021/1938020: 100%
Read error at 1938020/15/63 (lba=1953525167)

  Solaris /home                 34 1953525133 1953525100 [/seagate-1tb]



Disk /dev/ad6 - 1000 GB / 931 GiB - CHS 1938021 16 63
Analyse cylinder  1747/1938020: 00%


Warning: Incorrect number of heads/cylinder 255 (NTFS) != 16 (HD)
Warning: Incorrect number of heads/cylinder 255 (NTFS) != 16 (HD)
  MS Data                       63 1953520127 1953520065 [FreeAgent GoFlex Drive
  Solaris /home                 66 1953525165 1953525100
  Solaris /home                146 1953525245 1953525100 [/seagate-1tb]
  Solaris /home                178 1953525277 1953525100
  Solaris /home             376290 1953901389 1953525100
  Solaris /home             376402 1953901501 1953525100
  Solaris /home             752514 1954277613 1953525100
  Solaris /home             752626 1954277725 1953525100
  Solaris /home            1128738 1954653837 1953525100
  Solaris /home            1128850 1954653949 1953525100
  Solaris /home            1504962 1955030061 1953525100
  Solaris /home            1505074 1955030173 1953525100
  Stop
TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/ad6 - 1000 GB / 931 GiB - CHS 1938021 16 63

The harddisk (1000 GB / 931 GiB) seems too small! (< 1000 GB / 932 GiB)
Check the harddisk size: HD jumpers settings, BIOS detection...

The following partitions can't be recovered:
     Partition               Start        End    Size in sectors
>  Solaris /home                146 1953525245 1953525100 [/seagate-1tb]
   Solaris /home                178 1953525277 1953525100
   Solaris /home             376290 1953901389 1953525100
   Solaris /home             376402 1953901501 1953525100
   Solaris /home             752514 1954277613 1953525100
   Solaris /home             752626 1954277725 1953525100
   Solaris /home            1128738 1954653837 1953525100
   Solaris /home            1128850 1954653949 1953525100
   Solaris /home            1504962 1955030061 1953525100
   Solaris /home            1505074 1955030173 1953525100

[ Continue ]
UFS2, 1000 GB / 931 GiB

I can't run testdisk again at the moment, a pfsense upgrade changed some libs, but I should have that fixed shortly.

Thanks in advance! I'm very grateful for any help!

Edit: To clarify it's a FreeBSD partition formatted with UFS, not a UFS partition.

0

On UFS2 partition, sector 2 should contain part/slice list

sector 1 is boot record 0x200 bytes

sector 2 (count bytes started from beginning of partition):

0x200: header/name usually "WEV" upto "amnesiac"
..
0x290: slice a (root)
       0x294: slice size (in sector)
       0x298: start/offset (in sector)
0x2a0: slice b (swap)
0x2b0: slice c (alldisk)
       0x2b4: sum of all slices size (whole partition)
       0x298: 0
0x2c0 - 0x3f0: slice d - w

In your case, you should edit slice c to the size of partition (1953525100 sectors?), also slice a 0x294-0x29b, with equal values.

Clear MBR entry for NTFS, and fix the thankfully leftover UFS entry with ID 0x5A.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.