Text 20199, 131 rader
Skriven 2019-08-15 20:39:00 av Bbsing Bbs (5529.linux)
  Kommentar till text 20196 av Rick Christian (1:135/377)
Ärende: testdisk - Any good READM
=================================
-=> Rick Christian wrote to All <=-


 RC>    Hello everybody!

 RC> OK.. I've got a USB disk that worked fine.. then started to have some
 RC> hissy fits.. wouldn't write during rsync ops...

 RC> So for some reason it seems that it was getting hotter than normal,
 RC> although its been sitting in that spot for the last 6months or so???
USB thumb drives, that get to hot ... can crush the onboard memory chips, and
controller. 

 RC> Anyway... tl;dr

 RC> I put testdisk on a box... and it CAN FIND the partition that is there,
 RC> that won't mount now... and it CAN SEE THE dirs in the partition so
 RC> there is hope it might recover the data...

 RC> BUT

 RC> I'd like something that walks thru this step by step, that I can
 RC> review, think on, review , think on review some more...

 RC> I think I am just going to have Tarjay send me another 4TB drive and
 RC> back up the original and then use this for a test to learn how to
 RC> recover the partition and put back to use at least to read stuff....
 RC> and possibly recover another drive that exhibits similar behavior. (Was
 RC> stoped, unmounted, removed, and now wont remount..)

 RC> So any one got some GOOD for RISK AVERSE persons tutorials, FAQ's etc..
 RC> for testdisk?

 RC> I looked at their site and it seems more geared to HD experts vs. I
 RC> just want my stuff back (nothing critical) person.
Hi Rick, 

If your drive was part of a lvm volume group, you may be missing the other part
of that volume that is preventing you from seeing all the data. IF not then
what I attempt to write below may help. 

I'm not sure there is a recovery. USB ssd type drives (non-spinner drives),
have a write limit, eventually they just break. 
Now I've not broke a internal or MR2 type ssd yet, but plenty of USB thumb
drives, and micro ssd drives, and often times this is earlier than expected end
of life so they are still under warranty. 

If your computer is reporting a different size of the drive than manufacture
specification, you could have a controller issue, and that could be solved by a
controller swap. .. lots more steps for that recovery.

Here is what I usually do to test if the disk is broke, the easy way. 

Caveat, must use linux, the drive wasn't part of an lvm volume group:

find the device of the disk. This is usually known when plugging it into the
computer, then do the following:

	dmesg |grep sd

Another easy way is to do the following:

	sudo fdisk -lu

Both will produce some identifier about your drive. If it doesn't you may have
another issue, but from your statements above those two command should work
well enough.

Next ... now understand this is where you must be precise in your command
syntax and typing.

NOTE!!! dd can wipe out all data on your drive if used incorrectly. 
NOTE(2) dd can take a long long time to read a 4TB drive. 

I'll explain what I'm doing and show you and example. 
dd .. used to read the drive directly ignoring any partitions at all. 
using dd I read the device from start to finish. If it can't read the entire
device it usually gets stuck or errors out, and this happens with USB ssd type
devices right at the memory chip boundaries. Lets say you have a 8 gig USB
thumb drive, most often I've seen at the 4GB boundary the drive is broke, or
the 2G boundary, ... etc. 

from my command:

	dmesg |grep sd

I see a device [sdb] Attached SCSI removable disk ..
I use the dd command as follows:

	dd if=/dev/sdb of=/dev/null bs=512

eventually you'll get something like (i made up the numbers below):
	11118188+1 records in
	11118188+1 records out
	5000000000 bytes (5.7 GB, ... ) copied  ... 22 MB/s 
If the size of 5.7 GB happens to be the size of your device, you probably have
a good working drive, if not, you have a broken ssd and recovery is very
difficult. Good working drives with ext2,3,4 formats can usually get data back
with an: fsck 

dd will be attempting to read your drive device from start to finish. If it
finishes really early say after about 2GB when its a 8GB you see it, and it may
error out.

If you use the dd command as follows:

	dd if=/dev/sdb of=/dev/null bs=512 conv=noerror 

and it runs for days and days, you've got it stuck on some spot that is broke
on your drive, but .. the last time I've ever used dd on a USB thumb drive,
I've never seen this, I've only seen it stop reading prior to reading the
entire drive. 

If your dd can read the entire device, then you can used fsck on the drive, and
there are many options. 
Also if dd can read the entire device, I usually use dd to make an exact
duplicate of my drive, and operate on the image. 

	dd if=/dev/sdb of=./sdb.drive.img bs=512 conv=noerror,notrunc 

Then I start operating on the image. If this is an lvm type setup, ... way more
things to do,


For spinner drives .. there is a different process, you can use dd, but other
methods work depending on the partitions and format type. 

	
 
--- MultiMail/Linux v0.49
 * Origin: Electronic Warfare BBS | telnet:\\bbs.ewbbs.net (1:227/201)