[ale] help with LDE [linux disk editor]

[Greg Freemyer]

Courtney,

I'm still unsure what your issue is.

The Master Boot Record (MBR) (I think thats the right name) is
maintained in sector 0 of the entire drive.

In the old Cylinder/Head/Sector addressing scheme it was Cyl 0, Head
0, Sector 0.  In modern LBA terminology it is simply sector 0.  The
first partition traditionally starts at Cyl 0, Head 1, Sector 0.  With
most modern disks the internal drive electronics emulate a drive with
63 sectors per head, so that works out to Sector 63 being the start of
the first partition.

Anyway, I believe there is only one MBR per disk regardless of the
number of sectors.  With a standard Intel/Windows partition table a
small part of the MBR is used to hold the partition table.  I think
"man gpart" will tell you which bytes specifically hold the partition
table.

If the partition table within the MBR becomes corrupt, then a tool
like gpart can be used to recreate it.

Then for each filesystem there is a superblock.  The superblocks
reside within the partitions but the structure and layout is
filesystem dependent.  Some filesystems like XFS even maintain a
backup copy of the superblock.  Others like FAT32/NTFS don't call it a
superblock at all.

Hope the helps with terminology as you read about and research your problem.
Greg

On 11/26/06, Courtney Thomas <courtneycthomas at bellsouth.net> wrote:
> Thanks Greg, that's exactly, apparently, what I need, in that the superblock
> is seemingly gone.
>
> I'll try it.
>
> Sure will be glad when flashdisks are cheap and I never need to consider
> things that go round and round again  :-)
>
> Merry Christmas,
> Courtney
>
> ----- Original Message -----
> From: "Greg Freemyer" <greg.freemyer at gmail.com>
> To: "Atlanta Linux Enthusiasts" <ale at ale.org>
> Sent: Saturday, November 25, 2006 7:40 PM
> Subject: Re: [ale] help with LDE [linux disk editor]
>
>
> > Courtney,
> >
> > I've never used LDE, but I suspect it works at the partition level not
> > the disk level.
> >
> > If that is the case you need to try "lde /dev/hda1" to edit the first
> > primary partition on the disk.
> >
> > "fdisk -l /dev/hda" will tell you what partitions you have to choose from.
> >
> > If for some reason your partition table is destroyed, you may want to
> > look into gpart as a tool to recreate the partition table.
> >
> > Hope that helps
> > Greg
> >
> > On 11/25/06, Courtney Thomas <courtneycthomas at bellsouth.net> wrote:
> > > I'm tryin' to learn to use LDE and am experimenting with an old outta
> whack
> > > disk.
> > >
> > > When I...
> > >    lde /dev/hda
> > > the first screen comes up with an error screen, reporting....
> > >
> > >    root inode is not a dir
> > >    first block  (0) != normal first blk (1)
> > >    found ext2fs on device
> > >
> > >        inodes 252416
> > >        blocks 504000
> > >        firstdatazone 0 (N=1)
> > >        zonesize 4096
> > >        max size 1074791436
> > >
> > > 1-since root inode is not a dir, how do I convert it to a dir ?
> > >
> > > 2-what is the significance of the normal first block being 1 and this
> one's
> > > 0
> > >
> > > 3-what do you make of the numbers in the second block of data [5 lines]
> ?
> > >
> > > 4-by root inode, does LDE mean the superblock or block 1, I've assumed
> the
> > > superblock ?
> > >
> > > I hope that if I can resuscitate this disk, then when I run into
> real/active
> > > disk calamities,
> > > that I might be able to recover. Any suggestions for further information
>  on
> > > use of this tool ?
> > >
> > > Thank you,
> > > Courtney
> > >
> > > _______________________________________________
> > > Ale mailing list
> > > Ale at ale.org
> > > http://www.ale.org/mailman/listinfo/ale
> > >
> >
> >
> > --
> > Greg Freemyer
> > The Norcross Group
> > Forensics for the 21st Century
> > _______________________________________________
> > Ale mailing list
> > Ale at ale.org
> > http://www.ale.org/mailman/listinfo/ale
>
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://www.ale.org/mailman/listinfo/ale
>


-- 
Greg Freemyer
The Norcross Group
Forensics for the 21st Century