Hardware filesystem recovery - possible?

[Thulinma]

Hello all,

I'm hoping somebody here knows more about this than I do.

First some background:
My little brother's Wii recently randomly died. As in: on boot only a black screen and then "no signal" on the TV. He didn't do anything special that may have caused this (or so he claims, anyway).
Luckily I made a backup with BootMii as soon as it came out - so we were able to get it working again, no problem.

The thing is - that backup was ancient. He lost hundreds of hours of gameplay.
Knowing restoring a backup would wipe all the save data, I asked him to make another backup before the restore, in hopes of harvesting some of his precious savegames.
I have been investigating this "dead" backup since he sent it to me, and this is what I have so far:

- I made a modified version of Segher's zestig, able to display the metadata stored in all 16 superblocks, not just the currently active superblock.
- All superblocks had a number under 35 - which seemed rather low to me. All other backups I have seen had numbers in the thousands.
- All superblocks had metadata only detailing the following content:
/sys (folder with only 1 file: uid.sys)
/ticket (empty folder)
/title (empty folder)
/shared1 (empty folder)
/shared2 (empty folder)
/import (empty folder)
/meta (empty folder)
/tmp (empty folder)

That certainly explains why it would not boot anymore. Nearly all files have disappeared!
I did not try to get the raw clustes decrypted - which could be a next step. I don't think that would be useful for getting any savegames back though...

What I am wondering:
- What could cause something like this? There were no crazy hacks on this Wii, only bootmii (as boot2, thank god), homebrew channel, and for the rest a vanilla V4.2 Wii (did not install update to 4.3 yet when this happened). I am completely amazed at how suddenly the entire filesystem could get so corrupt (and very glad BootMii was installed

).
- Is there any chance of getting at least some of his savegames back? I never really investigated how exactly everything is stored on the Wii (never had the need to), and somebody else may know a "trick" or something like that that I haven't thought of yet...

Suggestions welcome!

PS: I am aware of the wii-fsck tool, but it doesn't seem to do any actual file recovery... so I don't think it will be useful in this case.

 

[Krestent]

Extract the bricked NAND.bin with ShowMiiWads and see if there is anything inside the title folder.

 

[Thulinma]

Like I indicated in the first post - all folders seem to be completely empty, except for the sys folder (which was one file).
This is only the metadata saying that though - It'd say it's highly likely the files are still on the nand, somewhere... just not in the metadata anymore.

Just to be sure I just now tried extracting the nand with ShowMiiWads, and it shows the exact same thing - all empty folders except for 1 file in sys.

 

[tueidj]

The /dev/fs pseudo device in IOS which handles all nand access has a "format" command (although I've never been game enough to find out exactly what it does). When IOS loads it tries to read the stats of the current nand and if there's an error it will call the format command... might help explain "what" happened but doesn't really explain "why".

 

[giantpune]

if you really trust bootmii, i would say you can restore the bricked dump to the wii and then see if you can read the FS. there is nand FS code in comex's nand formatter. so, take out the line that formats the nand. and take out the block that installs wads & writes the setting and ipslave files. what you are left with it a elf that runs from mini that lists the contents of the nand.

then run this elf and see if it finds anything other than what you already found. if it does find any files, you can just add a little bit that writes any file from the nand to the sd card.

 

[Thulinma]

Thanks for the suggestion - I downloaded the nand formatter sourcecode, and unfortunately it uses exactly the same method to access the nand as zestig does... so if that doesn't see any files, the nand formatter won't either...

The /dev/fs pseudo device in IOS which handles all nand access has a "format" command (although I've never been game enough to find out exactly what it does). When IOS loads it tries to read the stats of the current nand and if there's an error it will call the format command... might help explain "what" happened but doesn't really explain "why".

Yeah, it looks like this is what happened... but the "why"-part remains a mystery.

 

[Thulinma]

Eureka!
I wrote a quick program that simply decodes all the sectors of the NAND. Then used grep to find the names my little brother always uses for his characters, and was able to restore all of his most important savedata.

I guess that settles it - recovery of a few select files is possible!
That only leaves the question of how did this happen? My best theory so far is that he turned the Wii off during the writing of the superblock and it somehow got corrupted in a way that caused the Wii to format itself. Nasty stuff, that.

Oh well, I managed to restore what I was after, so I'm happy.
If anyone else is interested in the program that decodes all sectors of the nand feel free to contact me - I'll share the code, it's not very complicated after all.