file system recovery

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

I updatet yesterday to -CURRENT (from -CURRENT from about 09/20).

I use gbde, so I attached my gbde device (a partition, no md-device).
After mounting it I was not able to access files. An ls /mnt/crypto/
froze the system, I had to reboot.
After reboot fsck was not able to check the attached gbde device:
# fsck -t ufs /dev/ad0s2f.bde 
** /dev/ad0s2f.bde
** Last Mounted on /mnt/crypto
** Phase 1 - Check Blocks and Sizes
fsck_ufs: cannot alloc 2728847320 bytes for inoinfo

I downgraded to -CURRENT from 20040915, but it was also not able
to run fsck.

I also tried other superblocks (fsck -b), nothing changed, looks
like something else broke.

dumpfs core dumps (https://berlin.ccc.de/~hannes/dumpfs). I patched
dumpfs to ignore cg 1 (cause it contains invalid data), then it core
dumped at cg 2 (it had some other negative values in cg 2 nfree,..).

It looks like nbfree, ndir, nifree and nffree is in the cs[] struct.
Are there any tools to fix the file-system (with assumptions like
nbfree can't be negative)?

I tried sysutils/autopsy, but this was also not able to recover any
data. It returns "Out of memory during "large" request for 536875008
bytes, total sbrk() is 271708160 bytes at
/usr/ports/sysutils/autopsy/work/autopsy-1.73/autopsyfunc.pm line 2048."

Also the sysutils/sleuthkit toolset also does not work.
 (Cannot allocate memory).

dd if=/dev/ad0s2f.bde bs=1m count=20 skip=32 | strings
returns data which is (was?) on the file system.

Any ideas how to recover the data (apart from shell-skripts which use
dd and strings)?


Best Regards,

Hannes Mehnert
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (FreeBSD)

iD8DBQFBXvyzRcuNlziBjRwRApVuAJ9PejAVFZgcgqh4nyvVP01EYG+DGwCfWt+f
6XVOUA26dJ4sefxiy57StP8=
=mzIA
-----END PGP SIGNATURE-----