2

I have a f2fs partition with missing Superblock. I made a disk image so I would not destroy the original partition trying to fix.

sd-repair# fsck.f2fs sd128.img 
Info: Segments per section = 1
Info: Sections per zone = 1
Info: sector size = 512
Info: total sectors = 249737216 (121942 MB)
    Can't find a valid F2FS superblock at 0x0
    Can't find a valid F2FS superblock at 0x1

Testdisk doesn't support F2FS.

I don't know if there is a way to rewrite the superblocks, I would like to recover my files or repair the filesystem.

Here is hex of what I believe is F2FS superblock, from a good partition

10 20 F5 F2 01 00 07 00 09 00 00 00 03 00 00 00 0C 00 00 00 09 00 
00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 
E1 0F 00 00 FF 0F 00 00 02 00 00 00 02 00 00 00 12 00 00 00 08 00 
00 00 E1 0F 00 00 00 02 00 00 00 02 00 00 00 06 00 00 00 0A 00 00 
00 2E 00 00 00 3E 00 00 03 00 00 00 01 00 00 00 02 00 00 00 31 8B 
E4 FB 13 D1 42 26 A5 07 EA 8A B6 70 A9 45 

Here is the hex I found on bad partiton

10 20 F5 F2 01 00 07 00 09 00 00 00 03 00 00 00 0C 00 00 00 09 00 
00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 46 DC 01 00 00 00 00 
31 ED 00 00 22 EE 00 00 02 00 00 00 06 00 00 00 72 00 00 00 77 00 
00 00 31 ED 00 00 00 02 00 00 00 02 00 00 00 06 00 00 00 12 00 00 
00 F6 00 00 00 E4 01 00 03 00 00 00 01 00 00 00 02 00 00 00 16 CD 
C2 62 53 10 46 17 A5 B7 41 C6 8E AA 33 D5 73 00 64 00 2D 00 65 00 
78 00 74 00 

The superblock seems ok, differences are because of 1 is 128 GB part and other is 8 GB part. I don't know how to tell if the superblock is in the right location on bad partition. There offset don't match, from what I can tell. But I'm not that good with hex editors so I don't know how to compare there offsets.

Update: the offset for the superblock was wrong it was at 0x600 or 3 sector. I removed the first 512 bytes from the disk image. Now fsck.f2fs shows

sd-repair# fsck.f2fs -f trim_sd.img 
Info: Force to fix corruption
Info: Segments per section = 1
Info: Sections per zone = 1
Info: sector size = 512
Info: total sectors = 249704447 (121925 MB)
Info: MKFS version
  "Linux version 3.4.0-CM-g87d27dd (Adam@TheKeurig) (gcc version 4.9 20150123 (prerelease) 
(GCC) ) #6 SMP PREEMPT Sat Dec 17 21:28:57 CET 2016"

Info: FSCK version
  from "Linux version 4.9.0-3-amd64 (debian-kernel@lists.debian.org) 
(gcc version 6.3.0 20170516 (Debian 6.3.0-18) ) 
#1 SMP Debian 4.9.30-2 (2017-06-12)"
     to "Linux version 4.9.0-3-amd64 (debian-kernel@lists.debian.org)
(gcc version 6.3.0 20170516 (Debian 6.3.0-18) ) #1 SMP Debian 4.9.30-2 (2017-06-12)"

Info: superblock features = 0 : 
Info: superblock encrypt level = 0, salt = 00000000000000000000000000000000
Info: total FS sectors = 249704448 (121926 MB)
[f2fs_crc_valid: 477] CRC validation failed: cal_crc = 4076150800, blk_crc = 0 buff_size = 0x0
[f2fs_crc_valid: 477] CRC validation failed: cal_crc = 4076150800, blk_crc = 0 buff_size = 0x0
[f2fs_do_mount:1945] Can't find valid checkpoint

From what I can tell the partition has shifted, It might be on issue with partition table. All the data seems to be intact. Is is using ms-dos partition table.

  • testdisk doesn't repair filesystems, it only recovers partitions (which contain filesystems). The relevant tool would be the increasingly-misnamed photorec by the same author. I think it will work for F2FS, though I'm not sure. – sourcejedi Jun 17 '17 at 10:13
  • @sourcejedi it doesn't work. – Irfan Latif Jul 4 at 19:11
0

Depending on what you are trying to recover, you could try cat sd128.img | strings [options] | grep -C10 [pattern for recovery]. This is pretty terrible though. But could give you a lead where you data might begin.

This page on Forensic Wiki regarding SSDs might be useful reading, though it mostly addresses the complexity of the FTL (flash transition layer), which maps the system-visible block device to the multitude of memory chips in the SSD, and automatically performs wear-leveling, bad-block tracking, background optimization etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.