reallymine
reallymine copied to clipboard
andlabs
Problem with dumplast
I think this may be a duplicate of #58, but it is described differently there and the discussion has diverged from the trouble I'm having.
When I try to recover the last sector, I get an error:
~/go/bin > sudo ./reallymine dumplast /dev/rdisk6 out.bin
error running dumplast: non-empty sector not found
Using @themaddoctor's instructions on his linux-mybook-tools, I am able to get the necessary sector:
sudo dd if=/dev/rdisk6 bs=512 skip=3907024928 count=1 of=kb.bin
1+0 records in
1+0 records out
512 bytes transferred in 0.418056 secs (1225 bytes/sec)
~/scratch/wd > hexdump -C kb.bin
00000000 57 44 76 31 48 91 00 00 00 88 df e8 00 00 00 00 |WDv1H...........|
00000010 00 00 00 00 00 00 f0 00 00 00 00 00 00 00 00 00 |................|
00000020 01 00 00 00 00 00 46 50 00 00 00 00 00 00 00 00 |......FP........|
00000030 00 02 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000050 20 00 e9 6e 00 00 00 01 00 00 00 00 57 44 76 31 | ..n........WDv1|
00000060 75 a5 d6 57 64 0d a3 9c ff c5 fc a5 d5 56 15 4a |u..Wd........V.J|
00000070 41 5e a5 a3 f9 60 fd 89 1e 54 a9 fd 1a 70 ae b7 |A^...`...T...p..|
00000080 05 6b 37 1f bc 04 b6 e9 60 ed 62 c3 6a ee 15 ae |.k7.....`.b.j...|
00000090 1f 6c 97 b3 f8 63 b6 16 dd ed b8 2b 39 aa ca 5a |.l...c.....+9..Z|
000000a0 0d f3 94 f5 3e 28 1a c8 1b b0 f9 6f c0 88 d5 4e |....>(.....o...N|
000000b0 0f a9 1d 9d c4 31 57 18 d8 f8 43 04 c4 9b 3c a4 |.....1W...C...<.|
000000c0 20 2d 72 4e d0 ef c4 8a e2 c4 5b b9 a2 26 a4 7d | -rN......[..&.}|
000000d0 9b e0 05 4b 23 07 ce 3d bf 41 7a bd 75 de 4d 56 |...K#..=.Az.u.MV|
000000e0 fb e8 c3 d3 9a 06 b5 59 b5 4d a2 40 a0 ae c8 04 |.......Y.M.@....|
000000f0 f8 d8 45 d6 9a df f4 fe a0 b5 d6 96 13 a3 49 b3 |..E...........I.|
00000100 d8 e7 84 cc ed e7 8b 31 88 71 44 4a d6 e9 d5 7f |.......1.qDJ....|
00000110 71 06 e5 2f 6f ce d4 41 93 91 15 a8 08 c9 94 3f |q../o..A.......?|
00000120 9d dd a2 cf 35 22 1a 94 2f d4 a6 e9 fb ea 09 03 |....5"../.......|
00000130 ea 60 98 81 1d 64 c4 da cb bb e1 89 9a 22 b0 94 |.`...d......."..|
00000140 8e 68 00 3d 66 34 b5 72 e2 84 47 a5 d1 3f 09 e3 |.h.=f4.r..G..?..|
00000150 09 5b 20 53 da 94 0d 5c 73 60 f9 74 f2 b4 eb 2d |.[ S...\s`.t...-|
00000160 8a d7 2b 45 d9 2b 17 03 4d 36 2d 6e c6 50 26 5a |..+E.+..M6-n.P&Z|
00000170 c0 70 39 11 4a b3 21 f0 d3 53 b2 66 49 4a fb 84 |.p9.J.!..S.fIJ..|
00000180 78 db 0d 2f 40 5e b1 4b 7b 09 68 08 9c 13 43 9a |x../@^.K{.h...C.|
00000190 da 60 ad 90 71 4f af d8 4c d7 10 86 83 1b 0b 3c |.`..qO..L......<|
000001a0 f8 38 10 a4 6f be 91 80 82 29 9c 7c f7 fa 92 91 |.8..o....).|....|
000001b0 e3 eb 07 a2 79 fe 19 43 97 65 c2 c6 6a 6e d6 2e |....y..C.e..jn..|
000001c0 07 fd 8e 20 ce 6f 25 8d 72 51 e3 cd fd 2e b9 91 |... .o%.rQ......|
000001d0 27 bd 72 fb 31 6e 41 2c 67 81 9b 8c 56 ae 53 a5 |'.r.1nA,g...V.S.|
000001e0 84 74 3d e5 3f 01 4e 57 15 c5 64 0f 84 b4 37 65 |.t=.?.NW..d...7e|
000001f0 50 40 7f bd 64 4a 9f 46 bf 72 6c fa 8f c0 29 91 |[email protected]...).|
00000200
The sector seems to start with the magic WDv1.
I tried explicitly setting the disk size as described in the help, but it then claims that the disk isn't that big:
~/go/bin > sudo ./reallymine -disk-size 3907024928 dumplast /dev/rdisk6 -|hexdump
error running dumplast: requested disk size larger than actual disk size
~/go/bin > sudo ./reallymine -disk-size 3907024927 dumplast /dev/rdisk6 -|hexdump
error running dumplast: requested disk size larger than actual disk size
~/go/bin >
(note this is a 2 TB disk, and the number matches that I'm passing to dd.
It seems like there is something wrong with the determination of the disk size on macOS?
My machine is running macOS Sierra 10.12.5
I've compiled reallymine from scratch using go get https://github.com/andlabs/reallymine
Ideas?
Here's your disk key, if it helps: c28c3eb57110e75a65caefd966c61498ca6076d2c3ce2fb834e6facc2e0bb2a9
