Hi Amit,
You're not going like this news:
On 07/23/2016 12:00 AM, Bhatia Amit wrote:
> Following is the output from hexdump command you suggested above. Additionally, the r-linux tool that I had used to scan the disk for files, had claimed to find superblocks at multiple locations on disk. So, after the hexdump output, I have also dumped some information from hex output of the claimed superblock region, from three locations (first, middle and last superblock) on disk. Also, each superblock is claimed to occupy 2 sectors, but I have only pasted the first sector here, because the second sector is all zeros. The first two superblocks look to be exactly the same, but the last one seems a little different.
> fff80030 47 9d ba 50 03 00 1b 00 53 ef 00 00 01 00 00 00 |G..P....S.......|
> $ cat sblock.txt
>
> Name: Ext2/Ext3/Ext4 SuperBlock
> Offset (in sectors): 8387584
> Size (in sectors): 2
>
>
> Sector 8387584 (Parent: WDC WD30EZRX-00D8PB0 80.00A80 Record: 17419264)
>
> FFF80000: 00 46 B7 02 5F 8C B9 02 - 00 00 00 00 62 25 B6 02 .F.._.......b%..
> FFF80010: 1A 3B B7 02 00 00 00 00 - 06 00 00 00 06 00 00 00 .;..............
> FFF80020: F8 FF 00 00 F8 FF 00 00 - 00 FF 00 00 43 3E B3 4F ............C>.O
> FFF80030: 47 9D BA 50 03 00 1B 00 - 53 EF 00 00 01 00 00 00 G..P....S.......
> FFF80040: 3B B5 02 00 00 4E ED 00 - 00 00 00 00 01 00 00 00 ;....N..........
> FFF80050: 00 00 00 00 0B 00 00 00 - 00 01 01 00 3C 00 00 00 ............<...
> FFF80060: 42 02 00 00 7B 00 00 00 - B6 7F 9F FD 12 BF 4D 57 B...{.........MW
> FFF80070: A8 34 DD 09 E9 E8 BA C0 - 00 00 00 00 00 00 00 00 .4..............
> FFF80080: 00 00 00 00 00 00 00 00 - 2F 43 61 63 68 65 56 6F ......../CacheVo
> FFF80090: 6C 75 6D 65 00 C8 24 9E - 20 22 82 24 22 C8 1B 60 lume..$. ".$"..`
> FFF800A0: 60 FF FF FF 9C CA D0 E4 - 5C C8 13 41 80 C0 10 E6 `.......\..A....
> FFF800B0: 68 C8 08 21 60 CA D0 E4 - 5C 00 00 00 00 CD AC 46 h..!`...\......F
> FFF800C0: 80 C8 1C 5A 60 C8 24 9E - 00 00 00 00 00 00 20 00 ...Z`.$....... .
> FFF800D0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> FFF800E0: 08 00 00 00 00 00 00 00 - 00 00 00 00 FC ED 10 2F .............../
> FFF800F0: 38 44 66 85 D0 AC 7C A3 - FF F3 B0 AF 01 01 00 00 8Df...|.........
> FFF80100: 00 00 00 00 00 00 00 00 - 3B B5 02 00 0A F3 02 00 ........;.......
> FFF80110: 04 00 00 00 00 00 00 00 - 00 00 00 00 FF 7F 00 00 ................
> FFF80120: 78 EA B0 02 FF 7F 00 00 - 01 00 00 00 77 6A B1 02 x...........wj..
> FFF80130: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> FFF80140: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 80 ................
> FFF80150: 00 00 00 00 00 00 00 00 - 00 00 00 00 1C 00 1C 00 ................
> FFF80160: 02 00 00 00 FF 78 00 00 - 00 00 00 00 00 00 00 00 .....x..........
> FFF80170: 00 00 00 00 04 00 00 00 - 94 F3 87 01 00 00 00 00 ................
> FFF80180: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> FFF80190: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> FFF801A0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> FFF801B0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> FFF801C0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> FFF801D0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> FFF801E0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> FFF801F0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
>
>
>
> Name: Ext2/Ext3/Ext4 SuperBlock
> Offset (in sectors): 2038182912
> Size (in sectors): 2
>
>
> Sector 2038182912 (Parent: WDC WD30EZRX-00D8PB0 80.00A80 Record: 2047214592)
>
>
> F2F8680000: 00 46 B7 02 5F 8C B9 02 - 00 00 00 00 62 25 B6 02 .F.._.......b%..
> F2F8680010: 1A 3B B7 02 00 00 00 00 - 06 00 00 00 06 00 00 00 .;..............
> F2F8680020: F8 FF 00 00 F8 FF 00 00 - 00 FF 00 00 43 3E B3 4F ............C>.O
> F2F8680030: 47 9D BA 50 03 00 1B 00 - 53 EF 00 00 01 00 00 00 G..P....S.......
> F2F8680040: 3B B5 02 00 00 4E ED 00 - 00 00 00 00 01 00 00 00 ;....N..........
> F2F8680050: 00 00 00 00 0B 00 00 00 - 00 01 F3 00 3C 00 00 00 ............<...
> F2F8680060: 42 02 00 00 7B 00 00 00 - B6 7F 9F FD 12 BF 4D 57 B...{.........MW
> F2F8680070: A8 34 DD 09 E9 E8 BA C0 - 00 00 00 00 00 00 00 00 .4..............
> F2F8680080: 00 00 00 00 00 00 00 00 - 2F 43 61 63 68 65 56 6F ......../CacheVo
> F2F8680090: 6C 75 6D 65 00 C8 24 9E - 20 22 82 24 22 C8 1B 60 lume..$. ".$"..`
> F2F86800A0: 60 FF FF FF 9C CA D0 E4 - 5C C8 13 41 80 C0 10 E6 `.......\..A....
> F2F86800B0: 68 C8 08 21 60 CA D0 E4 - 5C 00 00 00 00 CD AC 46 h..!`...\......F
> F2F86800C0: 80 C8 1C 5A 60 C8 24 9E - 00 00 00 00 00 00 20 00 ...Z`.$....... .
> F2F86800D0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> F2F86800E0: 08 00 00 00 00 00 00 00 - 00 00 00 00 FC ED 10 2F .............../
> F2F86800F0: 38 44 66 85 D0 AC 7C A3 - FF F3 B0 AF 01 01 00 00 8Df...|.........
> F2F8680100: 00 00 00 00 00 00 00 00 - 3B B5 02 00 0A F3 02 00 ........;.......
> F2F8680110: 04 00 00 00 00 00 00 00 - 00 00 00 00 FF 7F 00 00 ................
> F2F8680120: 78 EA B0 02 FF 7F 00 00 - 01 00 00 00 77 6A B1 02 x...........wj..
> F2F8680130: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> F2F8680140: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 80 ................
> F2F8680150: 00 00 00 00 00 00 00 00 - 00 00 00 00 1C 00 1C 00 ................
> F2F8680160: 02 00 00 00 FF 78 00 00 - 00 00 00 00 00 00 00 00 .....x..........
> F2F8680170: 00 00 00 00 04 00 00 00 - 94 F3 87 01 00 00 00 00 ................
> F2F8680180: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> F2F8680190: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> F2F86801A0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> F2F86801B0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> F2F86801C0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> F2F86801D0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> F2F86801E0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> F2F86801F0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
These two superblocks above have a write timestamp of Sat Dec 01
19:13:59 EST 2012. Little endian "47 9D BA 50". See
https://ext4.wiki.kernel.org/index.php/Ext4_Disk_Layout#The_Super_Block
> Name: Ext2/Ext3/Ext4 SuperBlock
> Offset (in sectors): 5781334786
> Size (in sectors): 2
>
>
>
> Sector 5781334786 (Parent: WDC WD30EZRX-00D8PB0 80.00A80 Record: 5790366466)
>
>
> 2B130560400: 00 46 B7 02 5F 8C B9 02 - 00 00 00 00 25 7F 09 02 .F.._.......%...
> 2B130560410: DC F8 99 02 00 00 00 00 - 06 00 00 00 06 00 00 00 ................
> 2B130560420: F8 FF 00 00 F8 FF 00 00 - 00 FF 00 00 6D C8 02 57 ............m..W
> 2B130560430: 6D C8 02 57 2E 00 1B 00 - 53 EF 01 00 01 00 00 00 m..W....S.......
> 2B130560440: 3B B5 02 00 00 4E ED 00 - 00 00 00 00 01 00 00 00 ;....N..........
> 2B130560450: 00 00 00 00 0B 00 00 00 - 00 01 00 00 3C 00 00 00 ............<...
> 2B130560460: 46 02 00 00 7B 00 00 00 - B6 7F 9F FD 12 BF 4D 57 F...{.........MW
> 2B130560470: A8 34 DD 09 E9 E8 BA C0 - 00 00 00 00 00 00 00 00 .4..............
> 2B130560480: 00 00 00 00 00 00 00 00 - 2F 43 61 63 68 65 56 6F ......../CacheVo
> 2B130560490: 6C 75 6D 65 00 C7 4B BE - 20 24 82 24 82 C8 1B A0 lume..K. $.$....
> 2B1305604A0: 60 FF FF FF 9C C0 F1 11 - DC C8 13 2A A0 C0 10 E6 `..........*....
> 2B1305604B0: 68 C8 08 21 60 C0 F1 11 - DC 00 00 00 00 CF 3D 2A h..!`.........=*
> 2B1305604C0: E0 C2 94 C1 60 C7 4B BE - 00 00 00 00 00 00 20 00 ....`.K....... .
> 2B1305604D0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> 2B1305604E0: 08 00 00 00 00 00 00 00 - 00 00 00 00 FC ED 10 2F .............../
> 2B1305604F0: 38 44 66 85 D0 AC 7C A3 - FF F3 B0 AF 01 01 00 00 8Df...|.........
> 2B130560500: 00 00 00 00 00 00 00 00 - 3B B5 02 00 0A F3 02 00 ........;.......
> 2B130560510: 04 00 00 00 00 00 00 00 - 00 00 00 00 FF 7F 00 00 ................
> 2B130560520: 78 EA B0 02 FF 7F 00 00 - 01 00 00 00 77 6A B1 02 x...........wj..
> 2B130560530: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> 2B130560540: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 80 ................
> 2B130560550: 00 00 00 00 00 00 00 00 - 00 00 00 00 1C 00 1C 00 ................
> 2B130560560: 02 00 00 00 FF 78 00 00 - 00 00 00 00 00 00 00 00 .....x..........
> 2B130560570: 00 00 00 00 04 00 00 00 - D4 DD EB 54 00 00 00 00 ...........T....
> 2B130560580: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> 2B130560590: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> 2B1305605A0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> 2B1305605B0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> 2B1305605C0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> 2B1305605D0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> 2B1305605E0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
> 2B1305605F0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
This one has a write timestamp of Mon Apr 04 16:02:53 EDT 2016.
So more than half of this volume is old data, possibly part of an empty
default setup. The latter part of the disk, but less than half, is more
recent data.
I don't have anything more to suggest. I don't know of any way to get
just the good data, however much, at the end of the volume without the
first half of the disk.
Sorry,
Phil
--
To unsubscribe from this list: send the line "unsubscribe linux-raid" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
