.:: Marcos Dione/StyXman's glob ::. (Posts about disks)

Printing and identifying disks

Marcos Dione — Thu, 01 Jan 2026 13:41:06 GMT

Another short one. Seems like I haven't completed anything interesting lately, but I have a couple of things in the burner. Also, this is mostly for remembering this myself, because I always spend 30m to come up with this invocation¹. This is another of those you-wouldn't-need-to-read-this-post-if-you-read-manpages-from-time-to-time posts.

I have a laptop that's the web/home/media/backup server and it's the AP. For many reasons, it has 4 disks⁸. I also have like 10 other old disks laying around, waiting for the day I buy a not so old tower to replace the laptop (which is... 13yo). That day, identifying disks will be a necessity. So far, the best tool I have found that gives me an idea what is what is lsblk, but I'm not satisfied with its default output format:

mdione@diablo:~$ lsblk
NAME   MAJ:MIN RM   SIZE RO TYPE MOUNTPOINTS
sdb      8:16   0   1.8T  0 disk 
└─sdb1   8:17   0   1.8T  0 part /mnt/trash/mdione/public_html/Pictures
                                 /home/mdione/public_html/Pictures
                                 /home/backup
                                 /mnt/data
sdc      8:32   0 931.5G  0 disk 
├─sdc1   8:33   0    16G  0 part [SWAP]
└─sdc2   8:34   0 915.5G  0 part /
sdd      8:48   0 698.6G  0 disk 
└─sdd1   8:49   0 686.6G  0 part /home/mdione/public_html
                                 /mnt/trash
sde      8:64   0   1.8T  0 disk 
├─sde1   8:65   0  23.8M  0 part 
├─sde2   8:66   0   1.8T  0 part 
└─sde3   8:67   0  48.8G  0 part

Why? Because I don't care about MAJ:MIN, but also I need more info: partition table type², device model³, and at least available space⁴.

Now look at this⁹:

mdione@diablo:~$ lsblk --all --output NAME,TYPE,VENDOR,MODEL,REV,ROTA,HOTPLUG,RO,SIZE,PTTYPE,PARTTYPENAME,PARTUUID,PARTFLAGS,PARTLABEL,FSTYPE,FSSIZE,UUID,FSAVAIL,LABEL,FSROOTS,MOUNTPOINTS

This space intentionally left blank

It is a lot of info, but:

NAME: yes, and I love the tree.
TYPE: OK, this might be extra, but to this day nvme0n1 still feels like a partition, and not a whole device.
VENDOR: Yeah, OK, this looks useless for internal disks (the other two are connected via USB, see HOTPLUG).
MODEL: yes, please
REV: OK, not that I upgrade disk firmware ever...
ROTA: HDD vs SSD/Flash/NVME
HOTPLUG: mostly, USB, see VENDOR⁶
RO: maybe useful for RO SDs?
SIZE: of course. Unluckily I can't find how to ask for a consistent unit (see the G vs M vs T).
PTTYPE: dos/MBR vs gpt, which is BIOS/legacy vs UEFI.
PARTTYPENAME: might be misleading, see sdb1's and the file system it hosts.
PARTUUID: Debian refuses to allow specifying root partiition by label, and this machine detects disks in the 'wrong' order, rendering it unbootable if I use /dev/sdXY instead, so this is important⁸.
PARTFLAGS: 0x80 is DOS bootable partition, which I need in this non-UEFI machine⁷.
FSTYPE: of course.
FSSIZE: ditto
UUID: see PARTUUID.
FSAVAIL: of course.
LABEL: except for /, I mount by label. Sue me, Debian.
FSROOTS: My disk usage is weird⁸. To me it's imporatnt to know what is mounted where. The many entries with non / FSROOTs are bind mounts.
MOUNTPOINTS: Ditto.

So, in all, this command replaces mount and even mount -t ext4, df -h, fdisk -l, perusing dmesg and maybe more.

Yeah, OK, I made a script out of it, OK? And it's now deployed everywhere (2 machines :) via Ansible. ↩
For when I'm upgrading disks and the new one is not booting or something, like I did recently. ↩
To identify two very similar disks for said upgrades, or make sure that /dev/sda is not the main disk on the machine⁵ but a USB pen drive I want to write a rescue image on; otherwise, I would be /dev[astated]/sad. ↩
Who doesn't want to know this, right? ↩
Since I have a laptop that can handle NVME devices, this has been /dev/nvme0n1, but almost 3y of novelty can't beat more than two decades of precious /dev/sda. ↩
Yes, circular 'see', sue me. ↩
TBF, this machine supports it, but the hassle it means to activate that now is beyond what I'm prepared to fix. ↩
Rationale is like this: I have an internal SSD (not NVME, this machine is too old), this is /; an internal HDD for trash, mainly semi throwaway map tiles mounted in my public_html directory, and it's full; an external HDD, this is for local backup but also serves my pics from a subdir from my public_html; if I have to run and leave everything behind, this is the first/only thing I pick up; and the external NVME on a USB encasing, which is soon to replace the external HDD. ↩↩↩
Chízus, Nikola completely fsck'd it up. Sorry for the text file. And TBH, this does not even fits my terminal on a 170%¹⁰ 3840x2160 27" monitor, but at least looks fine in my navigator. ↩
I'm old, OK? ↩

Recovering partitions with pen and paper

Marcos Dione — Thu, 07 Apr 2011 21:49:04 GMT

Note: this is a translation of an old post. I decided to translate it because now I'm looking for a SysAdmin position (tell your friends!) and I would like this post to show how I work.

Last Saturday I received an email from one of the guys from work with the subject «urgennnnnnnnt: heeeeeeeeeelp»[sic]. He says he was idling on Friday night when his machine stopped emiting sound via the soundcard and then it behaved erratically. When he tried rebooting it, it didn't boot anymore. «It says something about disk not bootable...».

Monday morning I go to work and go to see the machine. Precisely, it said something about «disk not bootable». I boot with a USB key with GRML and I find that the disk has no partitions.

Panic.

The guy is doing a PostDoc in something astronomical (literally) and all his work is in that machine. No backups, as usual, so I prepare myself to rescue the partitions.

In that same USB key I have a system with parted. I boot with it and I try using parted's rescue tool. Nothing. I ask the guy how the disk was partitioned, etc. He tells me that he only installed Kubuntu clicking 'Next'. Kubuntu by default creates a swap partition and an ext3 partition for / and that's it, which made what was coming relatively easy.

I reboot in GRML and I use hexdump -C /dev/sda | more to see the disk's content. This is not the first time that I juggle with partitions and MBRs, but last time I did it, I used a tool that is now discontinued (the tool was called DiskEdit, included in The Norton Utilities), which had special edit modes for MBRs, FATs, and a lot of useful things... in MS universe.

First I confirm that, yes, the first sector is a MBR (at least it has the 0x55aa signature at the end), and that the whole partition table is empty, but in the second sector of the disk there seems to be a copy. I take pen and paper, write down what I found, but it turns out not only I have half the data, the partition I thought I found was too small.

So I decide to look for the partition by hand. To do that I needed to find out first how does the ext3 kernel code know wether a partition is ext3 or not. I knew it would be some kind of magic signature, but I had no idea which. So I installed the sources for 2.6.29 in my laptop and started to look at ext3's code. After going around a lot, including reading the code that is excuted when you mount a filesystem of type ext3, where we can see that it uses a magic signature³ and the structure of the ext3 superblock, where we can see the magic's offset is 0x38.

So the problem of finding an ext3 partition is reduced to the problem of finding 0x53ef (damn little endian) at a sector's offset 0x38 in the disk. Luckily more has a find tool, so I sit down to search every occurrence of 53 ef, hoping that the address at the left ends in 30 and that they would be the 9th and 10th bytes in the line (damn 0 based offsets).

A few 'next' after, I get my first candidate. It looks good, because I was also comparing my findings with a similar dump from my USB key (which I have formatted as ext2, and luckily ext2 and ext3 share those structures), and also I spot something that looks like a uuid.

This candidate's address is 0x80731038. I substract 0x38 and I get the address 0x80731000, a nice round number for a superblock. Converted to decimal that's 2.155.024.384, some 2GiB from the disk's begginning. Looks really good! The swap partition could be before the root one, and could have that size.

I use fdisk /dev/sda to see the (still empty) partition table. It says there's 16.065 sectors per cylinder, times 512 bytes per sector, equals 8.225.280 bytes per cylinder. Almost all distros (actually I think all of them) partition disks at cylinder boundaries¹, so if the sector I found is right at the beginning of a cylinder...

I divide 2.155.024.384/8.225.280=...

(suspense pause)²

262.000124494...

¡Damn! I almost had it... Hmm, how much is the factional part? (262.000124494-262)*8.225.280=... ¡1024! ¿Is it that...?

I run strace debugfs -R show_super_stats /dev/sdb1 (the partition in my USB key) and I see that it actually seeks 1024 bytes within the partition for reading the superblock!

This is it. With 262 in my head, I fire fdisk /dev/sda and I create two partitions: swap in cylinders 1-261 and root from cylinder 262 till the end. I save, cross my fingers and I run debugfs -R show_super_stats /dev/sda1. It fails! What's wrong? I reboot and I try again, just in case the kernel did not re-read correctly the partition table. It fails again. WTF?

Ah, duh, it's sda2, where do I have my head... Ok, debugfs -R show_super_stats /dev/sda2... it works, the sonofabitch works! I can't believe it. I risk it: fsck -n /dev/sda2. «Filesystem is clean». Damn, I try harder: fsck -n -f /dev/sda2...

Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information
/dev/sda2 etc etc...

It's fine! But the MBR doesn't have GURB installed, so I do the usual GRUB reinstall process, I reboot...

It boots like nothing has happened, and it finishes in a beautiful login. Satisifed, I pat myself in the back, pack my things and I start my weekend⁴.

... wasting some 8MiB between the MBR and the first partition. ↩
The sharp ones reading this will notice that this can not give an integer by no means. ↩
Reiser magics are funny. Looks like he started the fad that now AdOlEsCeNtS use. ↩
Update from 2023: yes, you got the math right. It took me a whole week of trial and error between other pressing tasks. ↩