--ZoaI/ZTpAVc4A5k6
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Sat, May 25, 2002 at 04:19:49PM +0200, Manuel Bouyer wrote:
> On Wed, May 22, 2002 at 11:19:11PM -0700, Hisashi T Fujinaka wrote:
> > I was moving disks and using partition magic, and I deleted my partition
> > table. And my disk label.
> > 
> > The data, I'm pretty sure, is still there. There's a win98 partition still
> > alive, and the netbsd stuff is hidden behind it. I figured (incorrectly)
> > that everything was standard, so if I just did a sysinstall with a
> > "preserve," I would have my correct disklabel back. Nope. Bad magic number
> > in the superblock. I must be off on my offsets.
> > 
> > Anyone have any hints for me? There's only one program I really need off
> > the disk (the perl program I was writing.)
> > 
> > Oh, I need to figure out how to rsync to my solaris box (the only one
> > which has a daily backup program.)
> 
> You can find supeblocks by scanning the disk looking for the magic
> number: 0x011954 (in a u_int32_t)
> The small attached program will look for this magic number, and print infos
> about the (supposed superblock). Of course there's a lot of flase positive,
> and it will also print alternate superblocks. Usage: ./lookforfs /dev/wd0d
> (better use the block device, it's much faster).

Hum, this versiom gives too much false positive. Here's another one,
which also check that "last mounted on" starts with a /

-- 
Manuel Bouyer <bouyer@antioche.eu.org>
--

--ZoaI/ZTpAVc4A5k6
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="lookforfs.c"

#include <fcntl.h>
#include <unistd.h>
#include <sys/param.h>
#include <ufs/ufs/dinode.h>
#include <ufs/ffs/fs.h>

main(int argc, char **argv)
{
	static char buf[2048];
	struct fs *fs;
	int fd;
	u_int64_t i;
	int j;

	fd = open(argv[1], O_RDONLY, 0);
	if (fd < 0) {
		perror("open");
		exit(1);
	}
	for (i = 0;;i++) {
		if (lseek(fd, i * 512, SEEK_SET) < 0) {
			perror("seek");
			exit(1);
		}
		if (read(fd, buf, sizeof(buf)) != sizeof(buf)) {
			perror("read");
			exit(1);
		}
		for (j = 0; j < sizeof(buf) - sizeof(struct fs); j+=4) {
			fs = (struct fs*)&buf[j];
			if (fs->fs_magic == FS_MAGIC &&
			    fs->fs_fsmnt[0] == '/') {
				printf("superblock in sector %qd:", i);
				printf("%u blocks, last mounted on %s\n",
				    fs->fs_size, fs->fs_fsmnt);
			}
		}
	}
	exit(0);
}

--ZoaI/ZTpAVc4A5k6--