Extracting certain files from faulty HD

Question

Hi, i'm trying to recover /home/kris/.zsnes/Legend of Zelda, The - A Link to the Past (U) [!].srm and (i guess, if i need it) /home/kris/.zsnes/Legend of Zelda, The - A Link to the Past (U) [!].zst first and foremost. They are zsnes and snes9x save files. I'm trying to recover them from a faulty HD which is an ext3 and is LVM2 formatted.
I can't mount the disk, nor does testdisk or photorec work(they both hang). SO since this is such a messed up drive i figured i would try to read the disk in hex and only extract the pieces i need to. I know "where" they are on the disk, as mentioned above, but i don't know where to go from here. I suppose to exert the disk as little as possible(to avoid more mucking up) i need to:
1. find out where the files are physically stored(hopefully they are in the same block/sector <- i don't really understand what this means _exactly_..)
2. read as little as possible/take as little a risk as possible and only extract exactly the bits needed and store them on the new HD as files.
But... HOW would i go about doing this, which programs would i use(the best would be if i could script it i suppose, as then i would only access exactly the portions i needed?) AND is there a better way? I'm thinking i could try ddrescue, but then i'd need to find out where these files are on disk first..

Answer 1

If you can't find any utilities that work, try this:
1. Create a few new .srm files, open them in a hex editor, and figure out what the header looks like (binary files usually start with something fairly identifiable so that e.g. zsnes knows it's looking at a proper .srm file).  If you're even luckier, the file might even contain the ROM name or say, the name you gave your character, as plain text.
2. Open the raw disk in a hex editor, and search for the header you figured out in step 1.
3. Copy out the data starting at the point you figured out in step 2, for the length an srm file is for a Legend of Zelda save (look at the files you made in step 1).
4. If you're lucky, the first one will work.  If not, rinse and repeat.  Depending on how much you figured out in step 1, you may end up having to copy over every .srm file to find the right one.  If you're unlucky, the file you're looking for could be corrupted, or if it's bigger than the block size of the drive (like hbekel said I think 4kB is a pretty typical value), it may be stored on non-consecutive blocks, in which case you're out of luck short of finding a tool that works.
I don't have any experience with hex editors in linux, although at first glance "hexedit" seems up to the task and is in the arch repos.
EDIT: I second hbekel's advice to image the drive ASAP in case it's a hardware failure.
Last edited by redden0t8 (2011-03-25 18:37:44)