Hacker News new | ask | show | jobs
by wayne_h 4665 days ago
I am currently working on a data recovery caused by 2tb limited bridge controller.

Customer had an external usb/firewire box with a 3tb drive. At 2tb the writes 'wrapped' back to block 0. Its a mac filesystem. Everything worked great until he wrote past 2tb. At that point it overwrote the beginning of the mac volume. The next time he connected the drive the mac thought that it was a new raw drive and told him that he needed to initialize the drive.

This is the second time he did this - the first time he didn't reinitialize it and we got it all back.

Unfortunately this time they initialized the drive. This zeroed out all the metadata, catalogs, maps etc - much bigger mess.

So some bridge controllers cannot handle drives larger than 2tb. 2tb is the last sector that you can address with a 4 byte disk address. So for sectors 0-0xffffffff .....works fine. The next sector is 0x100000000 - 5 bytes, it only sees the lower 4 bytes 0x00000000 and starts overwriting the beginning of the drive.

NTFS filesystems are more recoverable in this situation because their master file table starts 6 million sectors out on the drive so you would have to write alot more data before you start losing all your filenames and folder structures and pointers to the data.