Partition Magic 8 0 Serial Number 52
Randolfo Rasberry
I'm working on a midrange NAS system basically running on Linux and I got to do some great testing today. The step-by-step lead me to using fsdb to corrupt the magic number on a file system in order to corrupt it / test the script that should fix it.
A magic number is a sequence of bytes that is used in all files of a certain format, usually at a given position (often at the beginning). Since all files in that particular format have that particular byte sequence in that particular position, and most files in other formats don't have it, the magic number is a way to recognize what format a file is in.
The file command recognizes files based on their magic numbers. You can run file -s /dev/sda1 to see what it thinks is on the partition /dev/sda1. Its decisions are based on a database typically found in /etc/magic or /usr/share/misc/magic. Specific commands may use different magic numbers to recognize the file formats they can cope with.
I was going through the details of the linux boot process. It was understood that the primary boot loader resides in 512 byte image (program code + partition table). The 510 bytes comprise of executable code, error messages and partition table information. And the last 2 bytes contain a magic number 0xAA55. It was mentioned that "The magic number serves as a validation check of the MBR". Now what is the validation check? My guess is that it is some sort of check like CRC to make sure that MBR is not corrupt.
I searched on the net and there is no explanation for magic numbers and its working. But interesting thing is even Microsoft OS' also have magic numbers in their boot loaders. Can somebody enlighten us in this regard??????????????
"The 0xAA55 signature is the last two bytes of the first sector of yourbootdisk (bootsector/Master Boot Record/MBR). If it is 0xAA55, thenthe BIOS will try booting the system.If it's not found (it garbled or 0x0000), you'll get an error messagefrom your BIOS that it didn't find a bootable disk (or the systemtries booting the next disk).This signature is represented (in binary) as 0b1010101001010101. Thealternating bit pattern was thought to be a protection against certainfailures (drive or controller).
I don't remember what i did on arch last time (2 days ago) but i think nothing of special.
Today i updated windows, but i don' t think that matters.
However i still could boot into windows and ubuntu, so i booted into ubuntu and tried to fix grub.
Nothing changes.
I apt-get upgrade in ubuntu (i didn't use it for 2 years so i don't know why i did it), he did some changes on grub and now i can't boot on any system.
With efibootmgr i can see the windows boot loader, the arch-grub and 2 ubuntu-grub.
When i try to boot into arch i get the invalid magic number error, on ubuntu i get system is running in low graphics mode and doesn't start, while windows gives me a wonderful black screen.
I have a live usb with arch, but i really don't know what should i do.
I tried to do grub-install and grub-mkconfig.
The first one works successfully, while the second one gives me failed to connect to lvmetad.
If "pacman -Qkk linux" doesn't throw any errors (except a few in /usr/lib/modules), then you should be able to at least run mkinitcpio to genreate the default initramfs. If you get "==> Image generation successful" in the first half of the output then it worked. The second half of the output is only for the fallback image.
I just ran "grub-install ..". But this time without the --bootloader-id option and without run grub-mkconfig after that.
I solved the no space left problem on the boot partition moving away a FSCK0001.REC file (23MB).
The original "invalid magic number" issue is solved (yeah), however ubuntu gives me some errors (but i don't care, i'll remove it) and the windows boot loader doesn't work (that's a big problem).
Just a last little thing, that's my efibootmgr output:
I have to say thank you. through no fault but my own I killed my partition table and the was unable get to any of my data. (4tb worth) because of the is how to and the linked download to the partition magic everything is humming again. thank you for your help and guidance.
A very big thank you for this, i was meddling with the boot loader in windows when this error creeped into ubuntu, thankfully it is fine now.
you really saved me, was about to reinstall it entirely and reinstalling all the applications would have been a nightmare..
The superblock could not be read or does not describe a correct ext4
filesystem. If the device is valid and it really contains an ext4
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
e2fsck -b 8193
Nice to help you ? I found the answer by myself:
fsck.ext4 -p -b 884736 /dev/md0, but it doesnt work and i get still the error
Root Inode is no directory. clean? no
Error1: Corrupt extent header on inode 1049436
exit (translate from german)
how can i rescue my data?
I was fiddling with the new Ubuntu 11.04 and accidentally formatted my /home which was on a separate partition. It contains lots of docs, old pics and lot of scripts which was there for the last 3 years. Your post helped to recover it and you saved my life.
I am working through the same thing, does it say anything that Ubuntu 11.04 also gives me an error (tried all superblocks) above (bad magic) and I tried all the available superblocks
the drive is ext4 and the results of the e2fck refer to ext2 vs the ext4 in your output above.
Here is a hint to those that experience this problem, if the HD with the I/O read error is a SATA HD, it is possible to unplug the data (smaller) connector from the SATA HD, leaving the power (larger) connector plugged in and boot from a primary HD or from a rescue HD. After the boot has finished then plug in the data connector for the SATA HD.
Hi! for 2 weeks to try to solve the problem of my notebook! and this post could solve. The most interesting is the date of posting which is the same as my birthday! You saved my life and my neck! Thanks a lot!
I guess I would appreciate it if you could just look it over and tell me if you think I could get to the data without finding a way to build a raid of one member or that I do have to find a way, or else kiss my data good bye.
My first question is whether your method above will work for me despite the empty directory structure having been written? Presumably the old data is still there and hopefully can be recovered using a superblock backup.
I was actually able to fix this a few days ago. Installed vmfs-tools on a separate host, installed iscsi initiator (since this was an iscsi volume) and was able to mount that volume via vmfs-tools (instructions here =1592)
Many thanks for this post! It was really helpfull to me and now I have better overview how ext FS is working.
For me it was not so easy, when I was trying to use backup super block, it always failed for all backups with same error:
i tried resizing and rearranging my partitions with kde partition manager on a live USB, the idea being to take my boot drive and prepare it for a dd transfer to a faster drive i had. unfortunately, the operation failed after some 4 hours on the final step, checking the partitions. the end result is now i have no idea whats actually where on the disk, and i could really do to recover some of the configuration files, notes on things, and scripts i had stored in my home directory.
testdisk doesnt seem to find much of anything, sudo btrfs filesystem show /dev/sde yields nothing, sudo btrfs check /dev/sde finds no valid filesystems on it, all permutations of sudo btrfs inspect-internal dump-super with respect to existing partitions and superblock numbers yields either a blank result or ERROR: bad magic on superblock. im not even sure that the existing partitions line up with where the data would be, given i both re-arranged and shrunk various partitions.
beyond this i have no idea how best to proceed with data recovery. id wager theres a chance my configs and scripts exist on the disk to be found, but i dont know what tools or procedures i aught to be using on linux with respect to btrfs. anyone got any tips or things i should look at or into?
well that sounds like a fun way to spend a week kek. if i go about trying to find individual files, is there any tool for that on linux? iirc theres plenty of windows tools with that sort of functionality for raw disks.
the partitions all have the layout i wanted after the operation was complete, but some are unknown format according to kde partition manager. i have tried pointing said tools both at the raw disk device, as well as the partitions themselves, all to no avail.
good call. the first mystery partition is a valid NTFS one so apparently my windows partition was moved without issues, but the one im mainly interested in in the BTRFS linux one, which produces garbled output upon inspection of the partition its supposed to be in with hexdump.
That is strange; as mentioned above the superblock is actually much further within the partition; if you ran the command on a proper BTRFS partition, I think you should have just seen null bytes. For me to see anything, I had to hexdump all the way out to address 0x10100 (512 B more than 64 KiB).
My guess is that you happened to find the executable for a program that needs to parse BTRFS. The executable code for a partitioning program will need to have a copy of the magic value to know what to look for after all.
Ideally, we want to find two superblocks that are 64 MiB apart; then we will know where BTRFS thinks that the partition starts. My guess is that somehow your partition editor changed the partition table without actually moving data.
yep, sudo btrfs inspect-internal dump-super -a -s N /dev/sde_ where N ranges 0-2 and _ is numbers 3 and 6, because those align to where partitions were as far as i can remember, and where they should now be.
7fc3f7cf58