# Virgin Media UK Cisco CT8685 1TB



## nelem

Does any one have experience of this TiVo? I had a hard drive failure and managed to rescue virtually all data to a 3TB drive using ddrescue so I have a 1TB image on a 3TB drive which I want to expand but not having any joy.

Both the original and rescued drives boot BUT it doesn't seem to have a standard partition table.

JMFS-rev104 (from rosswalker.co.uk/tivo_upgrade) says No TiVo drives
MFSLive 1.4 sees partitions sda1-15,sbd1-15,sdc1-15,sdd1-15,sde1-15 All fake
MFS Tools 3.2 can't see the partition table.
SystemRescueCD doesn't see a partition table.

Should the partitions be visible to the booted OS. E.g. sda1-15?
What tools can I use to print the first sector?

Cheers


----------



## telemark

We can try to remote debug it. When hooked up to a Linux machine:
dd if=/dev/sdX count=64 | hexdump -C
Please copy/paste us the output instead of retyping it.

You can also try DvrBars and upload the resulting image.
Really we'd want that data from a known working drive instead of a suspect one.


----------



## nelem

Here is the first part of a 35k file. Full file attached. This is the failing disk but the failures are at about 750G into the disk.



Code:


00000000  14 92 03 06 72 6f 6f 74  3d 2f 64 65 76 2f 73 64  |....root=/dev/sd|
00000010  61 34 20 68 61 6e 64 63  72 61 66 74 3d 74 72 75  |a4 handcraft=tru|
00000020  65 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |e...............|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001f0  00 00 00 00 00 00 00 00  00 00 00 00 74 70 6d b0  |............tpm.|
00000200  50 4d 00 00 00 00 00 0e  00 00 00 01 00 00 00 3f  |PM.............?|
00000210  41 70 70 6c 65 00 00 00  00 00 00 00 00 00 00 00  |Apple...........|
00000220  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000230  41 70 70 6c 65 5f 70 61  72 74 69 74 69 6f 6e 5f  |Apple_partition_|
00000240  6d 61 70 00 00 00 00 00  00 00 00 00 00 00 00 00  |map.............|
00000250  00 00 00 00 00 00 00 3f  00 00 00 33 00 00 00 00  |.......?...3....|
00000260  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000270  00 00 00 00 00 00 00 00  2a b0 0b 14 00 00 00 01  |........*.......|
00000280  00 40 08 15 2a ac 18 a8  00 7e 90 a5 7f fb cc 58  |[email protected]*....~.....X|
00000290  2a b0 08 f8 2a ab dc 78  2a b0 81 20 7f fb cb 90  |*...*..x*.. ....|
000002a0  2a ab 19 94 00 00 00 01  00 40 08 15 00 7e 90 a5  |*[email protected]~..|
000002b0  00 40 06 c8 7f fb cb c0  2a b0 0a b8 00 00 00 00  |[email protected]*.......|
000002c0  2a ac 18 a8 00 00 00 00  00 00 00 00 00 00 00 01  |*...............|
000002d0  2a b0 81 20 00 40 df e1  04 00 57 18 2a ac 12 a8  |*.. [email protected]*...|
000002e0  00 00 00 12 00 00 00 00  7f fb cc dc 00 00 00 00  |................|
000002f0  00 00 00 19 7f fb ca f0  00 40 df 52 00 40 db 62  |[email protected]@.b|
00000300  10 00 2f 18 00 40 df c8  00 00 00 00 33 cf 4b 7e  |../[email protected]~|
00000310  00 00 00 00 ff ff ff ff  10 00 01 f0 00 00 00 ae  |................|
00000320  00 00 00 05 00 00 00 2e  00 00 00 00 00 00 00 00  |................|
00000330  00 00 00 00 10 00 10 68  2a b0 81 20 7f e2 16 00  |.......h*.. ....|
00000340  2a ab 50 9c ff ff ff ff  00 00 00 00 ff ff ff ff  |*.P.............|
00000350  00 00 00 30 2a b0 0b 14  2a ac 18 a8 00 00 00 03  |...0*...*.......|
00000360  00 00 00 00 7f fb cb 60  2a b0 81 20 00 00 00 00  |.......`*.. ....|
00000370  04 00 57 18 00 00 00 19  00 00 02 00 00 00 00 01  |..W.............|
00000380  10 00 10 08 00 00 00 03  2a b0 81 20 2a ab 51 b8  |........*.. *.Q.|
00000390  04 18 6d 20 04 18 6d 20  00 00 00 00 ff ff ff ff  |..m ..m ........|
000003a0  00 00 00 03 10 00 10 68  00 00 02 00 00 00 00 00  |.......h........|
000003b0  2a b0 81 20 00 40 b7 54  04 18 6d 20 00 40 a9 0c  |*.. [email protected] [email protected]|
000003c0  04 18 6d 20 00 40 df e4  00 00 00 00 04 0c 86 00  |..m [email protected]|
000003d0  10 00 81 e0 00 00 00 00  10 00 10 20 10 00 10 20  |........... ... |
000003e0  00 00 00 00 00 00 00 03  00 00 00 00 00 00 00 0d  |................|
000003f0  00 00 00 08 10 21 cd 50  10 00 81 e0 00 40 9c 9c  |[email protected]|
00000400  50 4d 00 00 00 00 00 0e  40 0a a2 30 00 00 00 01  |[email protected]|


----------



## jmbach

Need the first and last sectors of partition 10 to understand why you are getting the errors with MFSTools and JMFS.


----------



## nelem

How can I get the info you need? The partition table is not recognised by gparted or the OS and I can't mount any of the partitions.

I can try to read the disk directly at the offset of where those sectors should be. Using the partition below, 
offset 8 gives the partition start sector: 40 8f 22 32
offset 12 gives the length in sectors: 00 09 00 00
offset 80 (0x50) gives the data start sector in partition=0

So i need to read 0x408f2232 and 0x40982231. Is that correct?

dd if=/dev/sda skip=$((0x408f2232)) count=1 | hexdump -C
dd if=/dev/sda skip=$((0x40982231)) count=1 | hexdump -C

*Partition 10 in APM*


Code:


00001400  50 4d 00 00 00 00 00 0e  40 8f 22 32 00 09 00 00  |[email protected]"2....|
00001410  4d 46 53 20 61 70 70 6c  69 63 61 74 69 6f 6e 20  |MFS application |
00001420  72 65 67 69 6f 6e 00 00  00 00 00 00 00 00 00 00  |region..........|
00001430  4d 46 53 00 00 00 00 00  00 00 00 00 00 00 00 00  |MFS.............|
00001440  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00001450  00 00 00 00 00 09 00 00  00 00 00 33 00 00 00 00  |...........3....|
.....


----------



## nelem

I might have got this right as I've read both sectors and they are identical. I just hope they make sense.

*First Sector of Partition 10*



Code:


00000000  fd bd d2 c1 a7 66 36 86  e7 37 21 a3 61 f9 b0 5b  |.....f6..7!.a..[|
00000010  f1 c4 92 db 42 e3 4e cb  5f 4a 3f 3a 7d 47 20 22  |....B.N._J?:}G "|
00000020  a2 58 04 a9 01 ab bf 6b  db 0a d4 c2 b9 93 d6 6b  |.X.....k.......k|
00000030  f9 ff 7b 96 5c 4a 12 39  e8 c4 82 cc 95 8d 0d 03  |..{.\J.9........|
00000040  3d 36 4b de 85 f8 e3 ad  f3 fb f6 a5 57 1f 1c 24  |=6K.........W..$|
00000050  9b 91 9a 3b 23 c8 57 3b  12 05 0b 57 81 fc 6b 21  |...;#.W;...W..k!|
*
000000a0  55 79 b8 ec 10 39 ef 64  6c b8 b9 5c 14 f0 db fb  |Uy...9.dl..\....|
000000b0  7f 1b bb a6 3e 10 de c6  bf 40 c4 51 bc 31 91 be  |....>[email protected]|
000000c0  7e aa 46 17 ee 1d 35 a5  8a c8 96 eb ca 68 10 24  |~.F...5......h.$|
000000d0  bc f9 da 80 dd cc 1a 44  59 ee 93 60 f6 bc 18 76  |.......DY..`...v|
000000e0  36 9c e6 1f 6e c5 a8 f7  e6 60 88 4d 8f cd 9d 9d  |6...n....`.M....|
000000f0  e1 4e 04 75 95 f3 32 45  ab 1b 7e 81 46 0d 0e 17  |.N.u..2E..~.F...|
00000100  38 67 65 09 af 18 38 1b  5e 2e ae 84 20 7f 0c ea  |8ge...8.^... ...|
00000110  7d 06 18 b7 4b 95 4c 4b  0f 53 7b 06 41 0c fd e9  |}...K.LK.S{.A...|
00000120  9b 91 9a 3b 23 c8 57 3b  12 05 0b 57 81 fc 6b 21  |...;#.W;...W..k!|
*
00000200


----------



## telemark

Hm, that header is invalid if the offset is right.

Maybe, could you download my last utility and run the losetup command it gives you for #10

http://www.tivocommunity.com/tivo-vb/showthread.php?t=517407

Then it would normally be 
dd if=/dev/loop0 count=1 | hexdump -C

Unless your boot CD is using loop devices in which case it might loop1 or loop2 etc. It's a readonly command written this way so harmless if you run it on the wrong one.

losetup -a
tells you if there are other loop devices already allocated.

Sorry for throwing a lot of commands at you but you've done the prior ones easily so thought this was fastest.


----------



## nelem

Here is the output from pmdmp-static and dd respectively. I think I had correct offset to an invalid header.

The TiVo boots and runs though.



Code:


  1 (0200) : PM :  Apple_partition_map :                      'Apple' :           63 @            1
  2 (0400) : PM :                Image :                'Bootstrap 1' :            1 @   1074438704
  3 (0600) : PM :                Image :                   'Kernel 1' :        16384 @   1074438705
  4 (0800) : PM :                 Ext2 :                     'Root 1' :       524288 @   1074455089
  5 (0A00) : PM :                Image :                'Bootstrap 2' :            1 @   1074979377
  6 (0C00) : PM :                Image :                   'Kernel 2' :        16384 @   1074979378
  7 (0E00) : PM :                 Ext2 :                     'Root 2' :       524288 @   1074995762
  8 (1000) : PM :                 Swap :                 'Linux swap' :       262144 @   1075520050
  9 (1200) : PM :                 Ext2 :                       '/var' :      1048576 @   1075782194
 10 (1400) : PM :                  MFS :     'MFS application region' :       589824 @   1083122226
 11 (1600) : PM :                  MFS :           'MFS media region' :    869223294 @   1084301874
 12 (1800) : PM :                  MFS :   'MFS application region 2' :       589824 @   1083712050
 13 (1A00) : PM :                  MFS :         'MFS media region 2' :   1074438640 @           64
 14 (1C00) : PM :                 Ext2 :                     'SQLite' :      6291456 @   1076830770

  1 (0200) : PM :  Apple_partition_map :                      'Apple' :            1 +           63 =           64
 13 (1A00) : PM :                  MFS :         'MFS media region 2' :           64 +   1074438640 =   1074438704
  2 (0400) : PM :                Image :                'Bootstrap 1' :   1074438704 +            1 =   1074438705
  3 (0600) : PM :                Image :                   'Kernel 1' :   1074438705 +        16384 =   1074455089
  4 (0800) : PM :                 Ext2 :                     'Root 1' :   1074455089 +       524288 =   1074979377
  5 (0A00) : PM :                Image :                'Bootstrap 2' :   1074979377 +            1 =   1074979378
  6 (0C00) : PM :                Image :                   'Kernel 2' :   1074979378 +        16384 =   1074995762
  7 (0E00) : PM :                 Ext2 :                     'Root 2' :   1074995762 +       524288 =   1075520050
  8 (1000) : PM :                 Swap :                 'Linux swap' :   1075520050 +       262144 =   1075782194
  9 (1200) : PM :                 Ext2 :                       '/var' :   1075782194 +      1048576 =   1076830770
 14 (1C00) : PM :                 Ext2 :                     'SQLite' :   1076830770 +      6291456 =   1083122226
 10 (1400) : PM :                  MFS :     'MFS application region' :   1083122226 +       589824 =   1083712050
 12 (1800) : PM :                  MFS :   'MFS application region 2' :   1083712050 +       589824 =   1084301874
 11 (1600) : PM :                  MFS :           'MFS media region' :   1084301874 +    869223294 =   1953525168

  1 (0200) : PM :  Apple_partition_map :                      'Apple' :        32256 @          512
  2 (0400) : PM :                Image :                'Bootstrap 1' :          512 @ 550112616448
  3 (0600) : PM :                Image :                   'Kernel 1' :      8388608 @ 550112616960
  4 (0800) : PM :                 Ext2 :                     'Root 1' :    268435456 @ 550121005568
  5 (0A00) : PM :                Image :                'Bootstrap 2' :          512 @ 550389441024
  6 (0C00) : PM :                Image :                   'Kernel 2' :      8388608 @ 550389441536
  7 (0E00) : PM :                 Ext2 :                     'Root 2' :    268435456 @ 550397830144
  8 (1000) : PM :                 Swap :                 'Linux swap' :    134217728 @ 550666265600
  9 (1200) : PM :                 Ext2 :                       '/var' :    536870912 @ 550800483328
 10 (1400) : PM :                  MFS :     'MFS application region' :    301989888 @ 554558579712
 11 (1600) : PM :                  MFS :           'MFS media region' : 445042326528 @ 555162559488
 12 (1800) : PM :                  MFS :   'MFS application region 2' :    301989888 @ 554860569600
 13 (1A00) : PM :                  MFS :         'MFS media region 2' : 550112583680 @        32768
 14 (1C00) : PM :                 Ext2 :                     'SQLite' :   3221225472 @ 551337354240

  1 (0200) : PM :  Apple_partition_map :                      'Apple' :          512 +        32256 =        32768
 13 (1A00) : PM :                  MFS :         'MFS media region 2' :        32768 + 550112583680 = 550112616448
  2 (0400) : PM :                Image :                'Bootstrap 1' : 550112616448 +          512 = 550112616960
  3 (0600) : PM :                Image :                   'Kernel 1' : 550112616960 +      8388608 = 550121005568
  4 (0800) : PM :                 Ext2 :                     'Root 1' : 550121005568 +    268435456 = 550389441024
  5 (0A00) : PM :                Image :                'Bootstrap 2' : 550389441024 +          512 = 550389441536
  6 (0C00) : PM :                Image :                   'Kernel 2' : 550389441536 +      8388608 = 550397830144
  7 (0E00) : PM :                 Ext2 :                     'Root 2' : 550397830144 +    268435456 = 550666265600
  8 (1000) : PM :                 Swap :                 'Linux swap' : 550666265600 +    134217728 = 550800483328
  9 (1200) : PM :                 Ext2 :                       '/var' : 550800483328 +    536870912 = 551337354240
 14 (1C00) : PM :                 Ext2 :                     'SQLite' : 551337354240 +   3221225472 = 554558579712
 10 (1400) : PM :                  MFS :     'MFS application region' : 554558579712 +    301989888 = 554860569600
 12 (1800) : PM :                  MFS :   'MFS application region 2' : 554860569600 +    301989888 = 555162559488
 11 (1600) : PM :                  MFS :           'MFS media region' : 555162559488 + 445042326528 = 1000204886016

losetup -f /dev/sda --sizelimit 512
losetup -f /dev/sda --offset 512 --sizelimit 32256 	# 1 Apple
losetup -f /dev/sda --offset 550112616448 --sizelimit 512 	# 2 Bootstrap 1
losetup -f /dev/sda --offset 550112616960 --sizelimit 8388608 	# 3 Kernel 1
losetup -f /dev/sda --offset 550121005568 --sizelimit 268435456 	# 4 Root 1
losetup -f /dev/sda --offset 550389441024 --sizelimit 512 	# 5 Bootstrap 2
losetup -f /dev/sda --offset 550389441536 --sizelimit 8388608 	# 6 Kernel 2
losetup -f /dev/sda --offset 550397830144 --sizelimit 268435456 	# 7 Root 2
losetup -f /dev/sda --offset 550666265600 --sizelimit 134217728 	# 8 Linux swap
losetup -f /dev/sda --offset 550800483328 --sizelimit 536870912 	# 9 /var
losetup -f /dev/sda --offset 554558579712 --sizelimit 301989888 	# 10 MFS application region
losetup -f /dev/sda --offset 555162559488 --sizelimit 445042326528 	# 11 MFS media region
losetup -f /dev/sda --offset 554860569600 --sizelimit 301989888 	# 12 MFS application region 2
losetup -f /dev/sda --offset 32768 --sizelimit 550112583680 	# 13 MFS media region 2
losetup -f /dev/sda --offset 551337354240 --sizelimit 3221225472 	# 14 SQLite

Command run:
losetup -f /dev/sda --offset 554558579712 --sizelimit 301989888



Code:


00000000  fd bd d2 c1 a7 66 36 86  e7 37 21 a3 61 f9 b0 5b  |.....f6..7!.a..[|
00000010  f1 c4 92 db 42 e3 4e cb  5f 4a 3f 3a 7d 47 20 22  |....B.N._J?:}G "|
00000020  a2 58 04 a9 01 ab bf 6b  db 0a d4 c2 b9 93 d6 6b  |.X.....k.......k|
00000030  f9 ff 7b 96 5c 4a 12 39  e8 c4 82 cc 95 8d 0d 03  |..{.\J.9........|
00000040  3d 36 4b de 85 f8 e3 ad  f3 fb f6 a5 57 1f 1c 24  |=6K.........W..$|
00000050  9b 91 9a 3b 23 c8 57 3b  12 05 0b 57 81 fc 6b 21  |...;#.W;...W..k!|
*
000000a0  55 79 b8 ec 10 39 ef 64  6c b8 b9 5c 14 f0 db fb  |Uy...9.dl..\....|
000000b0  7f 1b bb a6 3e 10 de c6  bf 40 c4 51 bc 31 91 be  |....>[email protected]|
000000c0  7e aa 46 17 ee 1d 35 a5  8a c8 96 eb ca 68 10 24  |~.F...5......h.$|
000000d0  bc f9 da 80 dd cc 1a 44  59 ee 93 60 f6 bc 18 76  |.......DY..`...v|
000000e0  36 9c e6 1f 6e c5 a8 f7  e6 60 88 4d 8f cd 9d 9d  |6...n....`.M....|
000000f0  e1 4e 04 75 95 f3 32 45  ab 1b 7e 81 46 0d 0e 17  |.N.u..2E..~.F...|
00000100  38 67 65 09 af 18 38 1b  5e 2e ae 84 20 7f 0c ea  |8ge...8.^... ...|
00000110  7d 06 18 b7 4b 95 4c 4b  0f 53 7b 06 41 0c fd e9  |}...K.LK.S{.A...|
00000120  9b 91 9a 3b 23 c8 57 3b  12 05 0b 57 81 fc 6b 21  |...;#.W;...W..k!|
*
00000200


----------



## nelem

If this is still an invalid header, is there a string I can look for somewhere else?

I noticed the string handcraft=true in sector 0. Is this normal for TiVo or is it a clue?

Cheers


----------



## telemark

You're right that handcraft is normally off on US retail Tivo's. I would not tweak it without a backup though because no telling what will result. It would alter the path through some of the bootscripts.

I don't think it's the data corruption if the box is booting normally. I found a comment and I think what's going on is Virgin/Cisco departed from the common MFS format at some version number. I couldn't find anyone who has documented (presumably would be in the UK) the actual changes though. And the Americans don't have these boxes to compile them either.

I'll PM you directions, to see if we can bridge that divide.


----------



## nelem

@Telemark I've PM'd you but if anyone can shed any light on this I'll post the startup scripts affected by handcraft=true.



Code:


/mnt/tivo_root/etc/rc.d/StageE_PreApplication/rc.Sequence_010.BootStateDaemonChangeStage.Implementation_Gen07C.sh
/mnt/tivo_root/etc/rc.d/StageE_PreApplication/rc.Sequence_200.InvokeStressDiags.sh
/mnt/tivo_root/etc/rc.d/StageE_PreApplication/rc.Sequence_900.PostUpgrade.sh
/mnt/tivo_root/etc/rc.d/StageE_PreApplication/rc.Sequence_650.CleanupPlanetX.sh
/mnt/tivo_root/etc/rc.d/StageC_MediaInitialization/rc.Sequence_010.BootStateDaemonChangeStage.Implementation_Gen07C.sh
/mnt/tivo_root/etc/rc.d/StageA_PreKickstart/rc.Sequence_750.StartBootStateDaemon.Implementation_Gen07C.sh
/mnt/tivo_root/etc/rc.d/StageB_PostKickstart/rc.Sequence_010.BootStateDaemonChangeStage.Implementation_Gen07C.sh
/mnt/tivo_root/etc/rc.d/StageB_PostKickstart/rc.Sequence_225.CheckPanicLog.sh
/mnt/tivo_root/etc/rc.d/StageF_ApplicationLaunch/rc.Sequence_010.BootStateDaemonChangeStage.Implementation_Gen07C.sh
/mnt/tivo_root/etc/rc.d/StageF_ApplicationLaunch/rc.Sequence_200.StartApplication.sh
/mnt/tivo_root/etc/rc.d/StageF_ApplicationLaunch/rc.Sequence_100.CheckPerfLog.sh
/mnt/tivo_root/etc/rc.d/StageD_PreMfs/rc.Sequence_010.BootStateDaemonChangeStage.Implementation_Gen07C.sh
/mnt/tivo_root/etc/rc.d/StageG_PostApplication/rc.Sequence_010.BootStateDaemonChangeStage.Implementation_Gen07C.sh
/mnt/tivo_root/sbin/updateroot
/mnt/tivo_root/sbin/gimbal-diskinit
/mnt/tivo_root/sbin/update-disk
/mnt/tivo_root/sbin/build-disk
/mnt/tivo_root/tvbin/do.upgrade
/mnt/tivo_root/tvbin/install.autokick
/mnt/tivo_root/tvbin/handcraft.tcl

Thanks in advance.


----------

