Is this valid JFS partition?

0

My teacher gave my his laptop (with Fedora 16 on it) and compact flash card with data. He wants to have access to files on card, but he couldn't get access to it. The problem is Linux doesn't know what type of partion is. I suppose there is JFS:

root@debian:~# dmesg |grep sdc
[ 9066.908223] sd 3:0:0:1: [sdc] 3940272 512-byte logical blocks: (2.01 GB/1.87 GiB)
[ 9066.962307] sd 3:0:0:1: [sdc] Write Protect is off
[ 9066.962310] sd 3:0:0:1: [sdc] Mode Sense: 03 00 00 00
[ 9066.962312] sd 3:0:0:1: [sdc] Assuming drive cache: write through
[ 9067.028420] sd 3:0:0:1: [sdc] Assuming drive cache: write through
[ 9067.028637]  sdc: unknown partition table
[ 9067.097065] sd 3:0:0:1: [sdc] Assuming drive cache: write through
[ 9067.097281] sd 3:0:0:1: [sdc] Attached SCSI removable disk

and some of data:

root@debian:~# hexdump -Cn 65536 /dev/sdc
00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00008000  4a 46 53 31 01 00 00 00  48 63 0e 00 00 00 00 00  |JFS1....Hc......|
00008010  00 10 00 00 0c 00 03 00  00 02 00 00 09 00 00 00  |................|
00008020  00 20 00 00 00 09 20 10  02 00 00 00 00 00 00 00  |. .... .........|
00008030  04 00 00 00 26 00 00 00  02 00 00 00 24 00 00 00  |....&.......$...|
00008040  41 03 00 00 16 00 00 00  00 02 00 00 a0 cc 01 00  |A...............|
00008050  37 00 00 00 69 cc 01 00  b6 d8 ac 4b 00 00 00 00  |7...i......K....|
00008060  32 00 00 00 02 00 00 00  00 00 00 00 00 00 00 00  |2...............|
00008070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00008080  00 00 00 00 00 00 00 00  90 15 e5 5f e3 c4 45 fa  |..........._..E.|
00008090  9d 6a 5c b5 4f da 62 1a  00 00 00 00 00 00 00 00  |.j\.O.b.........|
000080a0  00 00 00 00 00 00 00 00  c3 c9 01 00 ed 81 00 00  |................|
000080b0  01 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000080c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
[cut]
*
0000f000  4a 46 53 31 01 00 00 00  48 63 0e 00 00 00 00 00  |JFS1....Hc......|
0000f010  00 10 00 00 0c 00 03 00  00 02 00 00 09 00 00 00  |................|
0000f020  00 20 00 00 00 09 20 10  00 00 00 00 00 00 00 00  |. .... .........|
0000f030  04 00 00 00 26 00 00 00  02 00 00 00 24 00 00 00  |....&.......$...|
0000f040  41 03 00 00 16 00 00 00  00 02 00 00 a0 cc 01 00  |A...............|
0000f050  37 00 00 00 69 cc 01 00  b6 d8 ac 4b 00 00 00 00  |7...i......K....|
0000f060  32 00 00 00 02 00 00 00  00 00 00 00 00 00 00 00  |2...............|
0000f070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0000f080  00 00 00 00 00 00 00 00  90 15 e5 5f e3 c4 45 fa  |..........._..E.|
0000f090  9d 6a 5c b5 4f da 62 1a  00 00 00 00 00 00 00 00  |.j\.O.b.........|
0000f0a0  00 00 00 00 00 00 00 00  c3 c9 01 00 ed 81 00 00  |................|
0000f0b0  01 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0000f0c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00010000

I'm total newbie to filesystems. I googled and found that JFS superblock may starts on 0x8000 offset. But what next? How to mount this card? If there would be normal partition table I would expect 55 AA on 510th and 511th byte, but first 8000 bytes are clear. Any help would be greatly appreciated.

Coolmax

Posted 2012-05-31T22:29:09.817

Reputation: 41

Maybe you just don't have the jfsutils package installed? That's required for mounting/unmounting JFS filesystems AFAIK. – devius – 2012-05-31T22:57:10.207

mmh it seems the partition table on the device is broken. First thing to do is taking an image of the entire drive with: dd if=/dev/sdc of=~/backup.img – guido – 2012-06-01T00:39:40.757

then, you could try recovering the partition table with testdisk http://www.cgsecurity.org/wiki/TestDisk

– guido – 2012-06-01T00:42:58.757

Depending on the files, running photorec would be a good idea too – Journeyman Geek – 2012-06-01T01:30:32.320

PhotoRec is able to recover files from this card. But I'm curious if I can mount this filesystem without any changes on card. I suspect that somebody wants to hide data. There are games for slot machines – Coolmax – 2012-06-03T19:35:24.787

No answers