DSM-G600, DNS-3xx and NSA-220 Hack Forum
Unfortunately no one can be told what fun_plug is - you have to see it for yourself.
You are not logged in.
Announcement
IRC Channel #funplug on irc.freenode.org
#1 2008-12-15 04:58:19
- jimmi1977
- New member
- Registered: 2008-12-15
- Posts: 2
dns-323 formatted wrong drive - ext2 gurus help wanted...
So I have put in a second drive, it asked me whether I want to format it, I said yes. Format proceeded. At that time, I tried to access my data, all was fine and dandy. So it was formatting correct (new) drive. Then it hang at around 94 percent. I waited for 10 minutes and rebooted the device. It asked me whether I want to format the drive again. And showed the id of a new drive. I said go ahead, and this time it formatted the drive with data!!!!! Hard to believe DLINK still has bugs like that in firmware version 1.05... And yes, I had only 1 copy of it.
Furious Dlink rant skipped.
Connected the formatted drive to computer, tried numerous recovery tools, including R-Linux. R-linux seems better of the bunch. It finds some files (using brute force scan of known file headers), but I had mostly mp3s and rar files, these are undetectable, and it doesn't handle fragmented files, so recovery rate is maybe 1%...
Now I need some ext2/mke2fs advice.
I am assuming mke2fs was used to format the drive, yes? And since it already had ext2 partition/filesystem there, and of the same size, it probably used the same block addresses to store inodes and inode backups. True or not? And if it used the same block addresses, it probably wiped the old inodes, so no hope for recovery?
I am willing to spend time with this drive, mounting it in linux and trying to recover semi-manually. Any hope? I think the fact that it had ext2 filesystem of the same size before is actually a disadvantage or am I wrong here?
Any advice?
Offline
#2 2008-12-15 05:06:37
- kenyloveg
- Member
- Registered: 2008-04-10
- Posts: 41
Re: dns-323 formatted wrong drive - ext2 gurus help wanted...
Dude, I've been through this as you are now.
http://dns323.kood.org/forum/t3057-Urge … -disk.html
These sh*tty software won't work at all, cuz they can only handle deleted files not format.
The only way to recover some of your data is at least you have your disk's partirion table backup. What i don't think you have.
Well, that's it and even you send your disk to data recovery corp won't work at all.
After all this, I start to believe that Windows system are better than Linux in somewhere.
Good luck!
Offline
#3 2008-12-15 10:56:10
- nickotar
- Member
- Registered: 2008-11-30
- Posts: 16
Re: dns-323 formatted wrong drive - ext2 gurus help wanted...
Did you try testdisk ? (see here : http://www.cgsecurity.org/wiki/TestDisk)
It helped me recover lost partitions. I don't know if it can recover files after partitionning but you should give it a try.
It's a free and powerfull tool.
Offline
#4 2008-12-21 05:43:11
- jimmi1977
- New member
- Registered: 2008-12-15
- Posts: 2
Re: dns-323 formatted wrong drive - ext2 gurus help wanted...
Ok, I feel I need to follow up. Happy ending in this complicated case.
In case of reformatting ext2 filesystem with ext2 again (same partition size), all superblock information is lost, and only hope is carving. I used several carving programs with no success - they recovered very small amount of real files - mostly small jpegs - and failed to recover large jpegs (or, if program was asked to recover brute force, it recovered larger files damaged). Not sure why carving is only successfull with smaller files on ext2... And I was mostly interested in large files. So, out of these programs, I cannot really recommend anything.
Another drive I had in this dns-323 was used for nightly backups from first drive that was reformatted. Before I realized I needed this backup drive, I overwrote 30% of data on this drive by unix dd command (i.e., STARTING 100gb or so of 320gb was overwritten by random data from some windows partition). I was lucky enough to copy partition table from reformatted drive to this one (lucky me, I had two identical 320gb hard drives, but not in raid 0, I used nightly backups), find a superblock copy (the last and only one left!) and then after 12hours or so of running fsck -y (I had to specify -b option to point to the last unoverwritten copy of superblock) I was able to mount it, there was lost+found folder with hundreds of thousands folders with cryptic names, but there was my data in there, intact. So after another 8 hours of manually carving it out (find, rm, mv, awk and friends) and verifying it, I have it back (first 100gb happened to be occupied with old files I had elsewhere. The new data was in the non-overwritten part...)
Phew. That was intense 
And ext2 engineers deserve a huge pat on their back for building in this amount of redundancy.
FYI, my data had 50000 files (around 250gb on 320gb drive), I had maybe 3 months (~100 days) worth of daily backups, so 5.000.000 inodes existed on my backup drive that fsck was able to fix in 12 hours... with 30% data overwritten (overwritten is even worse than badblocks, because this had random data with millions of other random inodes...)
ext2 + fsck = very robust. But not in case of reformat
Last edited by jimmi1977 (2008-12-21 05:46:58)
Offline