Recovering LhA archive from raw filesystem (DiskSalv failed)

[lem79]

Hi all,

I've got what seems to be a fairly challenging situation. Recently I got a friend to rip a disk image of my original 40mb 2.5" A1200 HD (it still works, 16 years old! ). I've run DiskSalv4 on it, and I've recovered files from the first partition (2 partitions, first recognised as NDOS, second as ?????), but only been marginally successful with the second. Any files that needed a file ext block (guessing bigger than ~32k?) would not recover and was truncated.

There's a file in the filesystem that I've seen in a hex editor, Mods.Lha. There's some of my own modules in there that are otherwise lost. I want to know if I can somehow pull the archive out of the filesystem and let LhA unpack it successfully.

At the moment, when I raw copy/paste from a hex editor, LhA goes through the data finding the -lh5- + filename headers, attempts decode saying "skipping corrupt/extraneous data", then fails and deletes the file it was extracting to. I'm thinking if I could somehow rip out the extraneous filesystem data, I could possibly restore the integrity of the archive and salvage the files that way.

Other than that, some of the files would be useful just with the first 30-50k of them, but LhA aborts and deletes the target file when extract fails.

So my questions:

1. Is it possible to manually repair this LhA archive? I've tried fixlha but it doesn't work (it does something since the mdsum of the archive changes). I know this is for repairing archives that have been sent as ASCII but it was worth a shot.

2. Is it possible for LhA to keep partial files? Or another application that could do this? The LhA packages in Ubuntu 9.04 don't even try to extract the files in the corrupt archive.

3. Are there any good file salvaging (rippers actually I guess) tools that I should try? I've tried DiskSalv 4 so far. Haven't tried ExoticRipper or anything yet.

Thanks very much for any advice. I'd be stoked if I could achieve this

[prowler]

Hi lem79, and welcome to EAB!

The problem with extracting archives using a binary file editor is that each disk sector has a header containing checksum information which is bloating the archive and preventing it from being extracted.

To remove this unwanted data, you will need to know the sector size and sector header size, and this will tell you how many bytes to remove and how regularly this must be done.

I have done something similar myself when recovering corrupted DMS floppy images. In this case the ADF sector size was 512 bytes, but I can't remember the header size. I made notes at time, but the data is on another machine.

I will look for these notes in case they can help you solve your problem. I'll let you know what I find.

prowler

[lem79]

Thanks for the welcome Prowler

Yep, I knew that was exactly what I needed to do, thanks for making it more specific. I believe this 40mb drive image (RDSK) contains the usual 512-byte sectors. I guess I'd need to know how to identify the sector boundaries too. LhA on the Amiga doesn't seem to care about headers for its own archives, as long as it finds "-lh5-" it'll start extracting. This helps me find where to start byte-copying, but where to start eliminating bytes and how much, yeah.. that's what your notes might help me do.

Cheers

[prowler]

Hi lem79,

From reading my notes, it seems that the sector header containing the checksum info for a sector size of 512 ($200) bytes is 24 ($18) bytes, and these will have to be removed from the archive before it will extract correctly.

Unfortunately, as you have found, LhA archives are of the 'solid' variety, i.e. no undamaged part of the archive will extract - it has to be all or nothing.

At the beginning of the file, you will find the tell-tale -lh5- signature. Actually, this is prefixed by two bytes, so that, in hex notation, the file will begin thus:

xx xx 2D 6C 68 35 2D ...

And before this will be the 24-byte header, at the beginning of which will be the first sector boundary.

So to repair the file, starting from the first sector boundary, you must strip the first 24 ($18) bytes, then skip the next 488 ($1E8), strip the next 24, and so on.

I carried out this process on my Windows PC using a binary file command line editing tool (SPLICE), invoked repeatedly with a batch file written in BASIC and output to a file in the form:
SPLICE CUT FILENAME START (I*488) LENGTH 24

I can upload these tools for you if you're interested.

However, there is one thing which will absolutely destroy any chance you have of easily recovering this file, and that is if the file is fragmented, which it could well be if it was first written to a fragmented hard disk.

If that has happened, then you will need to interpret the filesystem to see how the fragmented chains are resolved. I can't help you with this, because I didn't have that problem.

However, please let me know if I can be of any further help.

prowler

[lem79]

Prowler, that's brilliant, thanks very much. I'll have a go at writing my own script (probably in PHP) to do the bitstream chopping. I believe the file is contiguous since I can follow it sequentially in the hex editor. Thank God it doesn't appear fragmented. I don't necessarily need the whole file to extract properly anyway, the good bits are at the start

I'll let you know how I go

[lem79]

Actually one more question.. is your method above suitable for FFS-Intl? In the process of writing a script now.

[prowler]

I'm not sure. I've only ever recovered files from AmigaDOS floppy disks using that technique.

[lem79]

Cool thanks. I'm experimenting now.

[lem79]

Ok, I've been doing some testing with a floppy disk, FFS Intl formatted, and it appears you can have a file 36864 bytes long before a list extension block is required. There's no interruption to the file data (on a non-fragmented filesystem) in those 36864 bytes either, nothing to say where a sector starts or finishes. That would explain how files smaller than that survived recovery by DiskSalv, and also in LhA.

It seems that the data of the file resumes after (hex) FF FF FF FD (same as the very beginning of the file).

[lem79]

WOOHOO!!!! SUCCESS!!

Here's how it goes:

Get the start of the lha (+ 2 bytes preceding -lh5-), save 36864 bytes, drop 512 bytes, repeat until finished.

I just salvaged my LhA file, all files extracted successfully.

Thanks very much Prowler for putting me on the right path

[prowler]

Originally Posted by lem79

WOOHOO!!!! SUCCESS!!

Here's how it goes:

Get the start of the lha (+ 2 bytes preceding -lh5-), save 36864 bytes, drop 512 bytes, repeat until finished.

I just salvaged my LhA file, all files extracted successfully.

WOW! Well done, mate!

Originally Posted by lem79

Thanks very much Prowler for putting me on the right path

Not at all. You're very welcome.

prowler