I have a failing hard drive that is unable to write or read the first sectors of the disk. It just gives I/O errors and that is all there is. There are other areas on the disk that seem (mostly) fine.
I am trying to mount a partition (ext4) and see if I can access some files I would like to recover. Since the mount
command supports an offset
option, I should be able to mount the filesystem even though the partition table is unreadable and unwriteable. The problem is how to find the offset. None of the ext4 tools seems to have this particular feature.
Ext4 Filesystem – Find Offset
data-recoveryext4filesystemspartition
Best Answer
There isn't a standard offset per-se, as of course you can start the partition wherever you want. But let's assume for a moment that you're looking for the first partition, and it was created more or less accepting defaults. There are then two places you may find it, assuming you were using a traditional DOS partition table:
Now, to proceed, you'll want to pick up your favorite hex-dump tool, and learn a little about the ext4 Disk Layout. In particular, it starts with 1024 bytes of padding, which ext4 ignores. Next comes the superblock. You can recognize the superblock by checking for the magic number 0xEF53 at offset 0x38 (from the superblock start, or 0x438 from the partition start, or 1080 in decimal.) The magic number is little-endian. So it's actually stored on disk as 0x53EF.
Here is what that looks like with
xxd -a
:0000000: 0000 0000 0000 0000 0000 0000 0000 0000 ................ * 0000400: 0040 5d00 0084 7401 33a0 1200 33db a600 .@]...t.3...3... 0000410: 4963 5300 0000 0000 0200 0000 0200 0000 IcS............. 0000420: 0080 0000 0080 0000 0020 0000 6637 0952 ......... ..f7.R 0000430: 6637 0952 0200 1600 53ef 0100 0100 0000 f7.R....S....... 0000440: 9938 f851 004e ed00 0000 0000 0100 0000 .8.Q.N..........
Note, that when you give the offset to mount (or losetup), you must give the offset to where the padding starts—not the superblock.
Now, if its not the first partition, or otherwise isn't in one of the two (three) expected spots, you basically get to search for the magic number 0xEF53. This is what
testdisk
(recommended in a comment) does for you.