# Recovering a UFS partition in deleted slice



## kalda341 (Apr 27, 2013)

I have accidently overwritten my MBR with 

`fdisk -BI /dev/ada1`

and am unable to recover the data. Does anyone know any way to search the disk for the UFS partition and mount it?
Any help would be greatly appreciated.
Thanks.


----------



## kalda341 (Apr 27, 2013)

Okay, my plan is to do something like

`hexdump /dev/ada1 | grep $magicnumber`

but first I need to know what the UFS magic number is. I can't seem to find it anywhere.


----------



## kalda341 (Apr 27, 2013)

```
00364 #define       FS_UFS1_MAGIC 0x011954      /* UFS1 fast filesystem magic number */
00365 #define       FS_UFS2_MAGIC 0x19540119    /* UFS2 fast filesystem magic number */
00366 #define       FS_BAD_MAGIC  0x19960408    /* UFS incomplete newfs magic number */
```

Update. I have the magic number which I extracted from the UFS source code.  I am currently running 

`hexdump /dev/ada1 -s 300000000000 | grep -w '1954' > output`

to try and search for it. The -s 300000000000 is because I know it lies at least 300GB into the drive. The reason I have only searched for half the magic number is that I don't know for sure that both halves will end up on the line. Assuming I find it, does anyone know how I'd then mount it?


----------



## kalda341 (Apr 27, 2013)

I've found the magic number:

1c4eeb0a0 1954 0119 0a46 5550 7026 4a05 1082 8808

So I can add the bytes I've skipped and I have the address of the filesystem. Now, how do I mount it?


----------



## bkouhi (Apr 27, 2013)

I'm not sure if it helps, but try sysutils/testdisk. testdisk is a powerful utility.


----------



## tingo (Apr 28, 2013)

sysutils/ffs2recov is another tool, I've used it with success in the past in similar situations.


----------



## kalda341 (Apr 30, 2013)

I succeeded in using testdisk to recover a different partition that contained most of the data.


----------

