Mailing List Archive: Gentoo: Alpha

SOS : All my data is gone!

Index | Next | Previous | View Threaded

jean_seb at videotron

Apr 16, 2005, 5:09 PM

Post #1 of 15 (1729 views)
Permalink

SOS : All my data is gone!

Hi everyone,

Everyone's worst nightmare just happened to me. For no reason (that I
can see), all my data is gone from my Gentoo Alpha machine. I'll start
from the beginning...

The machine was running for about 4 days since last reboot. Everything
seemed fine. I had logged in through SSH from another machine and was
trying to do an emerge --sync, and it gave me lots of messages saying
that /var/cache/edb/... was read-only. For some reason, the / filesystem
was mounted read-only (it wasn't the last time I was working on it...
after the last reboot). So I tried to remount / read-write, but it said
it couldn't. So I figured had to reboot the system so it would remount
it read-write.

After the reboot, it came up with an error saying it couldn't mount the
root fs, and that I had to fix things manually. I entered the root
password, and ran fsck, answering yes to every prompt (as I always do, I
don't know enough about the filesystem to say "No! Don't fix inode
39047850 because that'll break everything!"... ) When I was done, the
system rebooted alone, and when MILO tried to start the kernel again, it
wasn't there anymore. The whole root partition seems to be totally empty
now.

My /tmp and /var/tmp partitions are still there though... *grins
sheepishly* Why isn't it ever those partitions that get wiped out? :-(

I had lots of data that I would rather not have lost on that partition
(though I can rebuild the system, nothing was absolutely essential, but
it would take a long time to get it back to how it was).

So my question is, let's say I boot with a Gentoo LiveCD, is there
anything I can do to try and recover some data from that partition? Or
is everything gone forever? (I REALLY hope the former is true, and not
the latter...)

Help me Gentoo-Alpha List, you're my only hope...

Thanks in advance,

J-S

--
___________________________________________
Jean-Sébastien Guay jean_seb [at] videotron
http://whitestar02.webhop.org/

--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.308 / Virus Database: 266.9.13 - Release Date: 2005/04/16

--
gentoo-alpha [at] gentoo mailing list

brianp at spamcop

Apr 16, 2005, 5:50 PM

Post #2 of 15 (1664 views)
Permalink

Re: SOS : All my data is gone! [In reply to]

Have you tried booting with the latest LiveCD? If so you may be able
mount the filesystem and read the data you need off (e.g. scp to another
host.)

I last tried the 2004.3 liveCD and was not able to read my DAC960 raid5
drives. I've not tried the 2005.1 livecd yet, but I have been able to
recover before by booting my system off of the additional 9 GB drive I
have in the system.

Brian..

On Sat, 2005-04-16 at 20:09 -0400, Jean-Sébastien Guay wrote:
> Hi everyone,
>
> Everyone's worst nightmare just happened to me. For no reason (that I
> can see), all my data is gone from my Gentoo Alpha machine. I'll start
> from the beginning...
>
> The machine was running for about 4 days since last reboot. Everything
> seemed fine. I had logged in through SSH from another machine and was
> trying to do an emerge --sync, and it gave me lots of messages saying
> that /var/cache/edb/... was read-only. For some reason, the / filesystem
> was mounted read-only (it wasn't the last time I was working on it...
> after the last reboot). So I tried to remount / read-write, but it said
> it couldn't. So I figured had to reboot the system so it would remount
> it read-write.
>
> After the reboot, it came up with an error saying it couldn't mount the
> root fs, and that I had to fix things manually. I entered the root
> password, and ran fsck, answering yes to every prompt (as I always do, I
> don't know enough about the filesystem to say "No! Don't fix inode
> 39047850 because that'll break everything!"... ) When I was done, the
> system rebooted alone, and when MILO tried to start the kernel again, it
> wasn't there anymore. The whole root partition seems to be totally empty
> now.
>
> My /tmp and /var/tmp partitions are still there though... *grins
> sheepishly* Why isn't it ever those partitions that get wiped out? :-(
>
> I had lots of data that I would rather not have lost on that partition
> (though I can rebuild the system, nothing was absolutely essential, but
> it would take a long time to get it back to how it was).
>
> So my question is, let's say I boot with a Gentoo LiveCD, is there
> anything I can do to try and recover some data from that partition? Or
> is everything gone forever? (I REALLY hope the former is true, and not
> the latter...)
>
> Help me Gentoo-Alpha List, you're my only hope...
>
> Thanks in advance,
>
> J-S
>
> --
> ___________________________________________
> Jean-Sébastien Guay jean_seb [at] videotron
> http://whitestar02.webhop.org/
>
>
>
> --
> No virus found in this outgoing message.
> Checked by AVG Anti-Virus.
> Version: 7.0.308 / Virus Database: 266.9.13 - Release Date: 2005/04/16
>

--
gentoo-alpha [at] gentoo mailing list

gabriel at teuton

Apr 16, 2005, 7:21 PM

Post #3 of 15 (1664 views)
Permalink

Re: SOS : All my data is gone! [In reply to]

On Saturday 16 April 2005 07:09 pm, Jean-Sébastien Guay wrote:
>
> The machine was running for about 4 days since last reboot. Everything
> seemed fine. I had logged in through SSH from another machine and was
> trying to do an emerge --sync, and it gave me lots of messages saying

What maintenance activities have you done lately? (Esp. those that led you to
reboot, and those subsequent to then.)

> So my question is, let's say I boot with a Gentoo LiveCD, is there
> anything I can do to try and recover some data from that partition? Or
> is everything gone forever? (I REALLY hope the former is true, and not
> the latter...)

I would guess yes, you can probably boot to a LiveCD and recover whatever
could be recovered. Just be careful to mount things read-only.

> Help me Gentoo-Alpha List, you're my only hope...

You're beauuuuuu-tiful!

--
G a b r i e l M . B e d d i n g f i e l d
...........................Today's fortune cookie.......................
We're living in a golden age. All you need is gold.
-- D.W. Robertson.
........................................................................

--
gentoo-alpha [at] gentoo mailing list

jean_seb at videotron

Apr 16, 2005, 7:48 PM

Post #4 of 15 (1665 views)
Permalink

Re: SOS : All my data is gone! [In reply to]

Hello Gabriel,

>What maintenance activities have you done lately? (Esp. those that led you to
>reboot, and those subsequent to then.)
>
>
I upgraded my kernel to 2.6.12-rc2 (vanilla-sources). Then I let it run
for a couple days to see if it ran OK. And the last time I rebooted
(prior to this time) was about 4 days ago when I went into my AlphaBIOS
to make the new kernel the default boot option.

>I would guess yes, you can probably boot to a LiveCD and recover whatever
>could be recovered. Just be careful to mount things read-only.
>
>
Are there any commands I should know about that would help me to recover
the filesystem? Because from the MILO prompt, if I do 'ls /dev/sdb5:/',
all I get are the current (.), parent (..) and 'lost+found' directories
(meaning, it looks as if the drive is completely empty, as if it had
just been reformatted).

Anyways, I'll try it and see what happens... Thanks for your help.

J-S

--
___________________________________________
Jean-Sébastien Guay jean_seb [at] videotron
http://whitestar02.webhop.org/

--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.308 / Virus Database: 266.9.13 - Release Date: 2005/04/16

--
gentoo-alpha [at] gentoo mailing list

jean_seb at videotron

Apr 16, 2005, 8:11 PM

Post #5 of 15 (1663 views)
Permalink

Re: SOS : All my data is gone! [In reply to]

Hi again, replying to myself...

> Are there any commands I should know about that would help me to
> recover the filesystem? Because from the MILO prompt, if I do 'ls
> /dev/sdb5:/', all I get are the current (.), parent (..) and
> 'lost+found' directories (meaning, it looks as if the drive is
> completely empty, as if it had just been reformatted).

I can confirm that once I booted with the LiveCD,
a) the FS would not mount at first
b) when I ran fsck on it, it reported a bad journal, which I fixed.
c) then it mounted all right (read-only) but it has no files on it, as
if it was freshly formatted.

Please tell me there's something I can do to get the data off the drive...

J-S

--
___________________________________________
Jean-Sébastien Guay jean_seb [at] videotron
http://whitestar02.webhop.org/

--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.308 / Virus Database: 266.9.13 - Release Date: 2005/04/16

--
gentoo-alpha [at] gentoo mailing list

jeff_donsbach at yahoo

Apr 17, 2005, 5:30 PM

Post #6 of 15 (1661 views)
Permalink

Re: SOS : All my data is gone! [In reply to]

I tried booting the 2005.0 LiveCD on my XLT and I
couldn't be either the 2.6 kernel, nor the 2.4 kernel.
Hope J-S has better luck than I.
(and J-S, if you do, please share your secret!)

--- Brian Parkhurst <brianp [at] spamcop> wrote:
> Have you tried booting with the latest LiveCD? If
> so you may be able
> mount the filesystem and read the data you need off
> (e.g. scp to another
> host.)

__________________________________
Do you Yahoo!?
Yahoo! Mail - You care about security. So do we.
http://promotions.yahoo.com/new_mail
--
gentoo-alpha [at] gentoo mailing list

rikjoh at norweb

Apr 17, 2005, 5:44 PM

Post #7 of 15 (1664 views)
Permalink

Re: SOS : All my data is gone! [In reply to]

On Monday 18 April 2005 02.30, Jeff Donsbach wrote:
> I tried booting the 2005.0 LiveCD on my XLT and I
> couldn't be either the 2.6 kernel, nor the 2.4 kernel.
> Hope J-S has better luck than I.
> (and J-S, if you do, please share your secret!)
>
> --- Brian Parkhurst <brianp [at] spamcop> wrote:
> > Have you tried booting with the latest LiveCD? If
> > so you may be able
> > mount the filesystem and read the data you need off
> > (e.g. scp to another
> > host.)
>
> __________________________________
> Do you Yahoo!?
> Yahoo! Mail - You care about security. So do we.
> http://promotions.yahoo.com/new_mail

What filesystem are you using?

I had a similar mishap with a reiserfs system loosing all the data on
2x30 GB disks. (both full to about 85%)
It turned out to be a trashed journal that could (to some extent) be salvaged
via rescueattempts using the ordinary reiserfs tools.

--

/Rikard

" Sharing knowledge is the most fundamental act of friendship.
Because it is a way you can give something without loosing something."
-R. Stallman

---------------------------------------------------------------
Rikard Johnels email : rikjoh [at] norweb
Web : http://www.rikjoh.com/users/rikjoh
Mob : +46 735 05 51 01
PGP : 0x461CEE56
---------------------------------------------------------------
--
gentoo-alpha [at] gentoo mailing list

jeff_donsbach at yahoo

Apr 17, 2005, 6:03 PM

Post #8 of 15 (1664 views)
Permalink

Re: SOS : All my data is gone! [In reply to]

J-S,

Before you start reinstalling (after you recover
whatever you can), you might want to check that disk
for bad blocks. I recently had one of the original
RZ26's in my XLT give it up. Fortunately, I only used
it for swap and /usr/portage so swapping in a "new"
disk was easy. Interestingly, my mysterious system
hangs have also disappeared. I bet they might have
been caused by bad blocks on the swap partition.

Jeff D

__________________________________
Do you Yahoo!?
Read only the mail you want - Yahoo! Mail SpamGuard.
http://promotions.yahoo.com/new_mail
--
gentoo-alpha [at] gentoo mailing list

jean_seb at videotron

Apr 17, 2005, 7:57 PM

Post #9 of 15 (1664 views)
Permalink

Re: SOS : All my data is gone! [In reply to]

Hello Rikard,

>What filesystem are you using?
>
>

I was using ext3.

>I had a similar mishap with a reiserfs system loosing all the data on
>2x30 GB disks. (both full to about 85%)
>It turned out to be a trashed journal that could (to some extent) be salvaged
>via rescueattempts using the ordinary reiserfs tools.
>
>

When I rebooted with the 2004.3 LiveCD, I ran e2fsck on the drive, and
it said my journal was corrupted. It deleted it, and said I needed to
run tune2fs -j on the drive again to recreate it. But even after that,
the data still seems to be lost (the drive is totally empty).

What I think I'll do next is install a SCSI card in a Windows PC I have,
and try some recovery tools like for example
http://www.data-recovery-software.net/Linux_Recovery.shtml ... Don't
know if that will work though. If someone can suggest something else...
Maybe the data is still there but just not accessible via the
filesystem, how could I go about trying to retrieve it?

Thanks for the suggestions though, at least I'm trying things...

J-S

--
___________________________________________
Jean-Sébastien Guay jean_seb [at] videotron
http://whitestar02.webhop.org/

--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.308 / Virus Database: 266.9.15 - Release Date: 2005/04/16

--
gentoo-alpha [at] gentoo mailing list

jean_seb at videotron

Apr 17, 2005, 8:00 PM

Post #10 of 15 (1660 views)
Permalink

Re: SOS : All my data is gone! [In reply to]

The following random bytes came from Jeff Donsbach's keyboard :

>I tried booting the 2005.0 LiveCD on my XLT and I
>couldn't be either the 2.6 kernel, nor the 2.4 kernel.
>Hope J-S has better luck than I.
>(and J-S, if you do, please share your secret!)
>
>
I just booted the 2004.3 LiveCD yesterday. Haven't tried the 2005.0, but
I think the kernels are compiled with the LEGACY_ADDRESS option turned
off in the kernels, and that's why they don't boot o XLT. Not sure though.

I'll give it a try soon, once I run out of ideas to try and get back my
data...

J-S

--
___________________________________________
Jean-Sébastien Guay jean_seb [at] videotron
http://whitestar02.webhop.org/

--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.308 / Virus Database: 266.9.15 - Release Date: 2005/04/16

--
gentoo-alpha [at] gentoo mailing list

brianp at spamcop

Apr 17, 2005, 8:36 PM

Post #11 of 15 (1664 views)
Permalink

Re: SOS : All my data is gone! [In reply to]

Just a thought, have you looked into autopsy and the various forensic
toolkits (e.g. TCT (the coroners toolkit))
available for linux?

It may be able to recover more of your data. You may need to be able to
compile them for alpha though.

Brian Parkhurst

----- Original Message -----
From: "Jean-Sébastien Guay" <jean_seb [at] videotron>
To: <gentoo-alpha [at] lists>
Sent: Sunday, April 17, 2005 7:57 PM
Subject: Re: [gentoo-alpha] SOS : All my data is gone!

> Hello Rikard,
>
> >What filesystem are you using?
> >
> >
>
> I was using ext3.
>
> >I had a similar mishap with a reiserfs system loosing all the data on
> >2x30 GB disks. (both full to about 85%)
> >It turned out to be a trashed journal that could (to some extent) be
salvaged
> >via rescueattempts using the ordinary reiserfs tools.
> >
> >
>
> When I rebooted with the 2004.3 LiveCD, I ran e2fsck on the drive, and
> it said my journal was corrupted. It deleted it, and said I needed to
> run tune2fs -j on the drive again to recreate it. But even after that,
> the data still seems to be lost (the drive is totally empty).
>
> What I think I'll do next is install a SCSI card in a Windows PC I have,
> and try some recovery tools like for example
> http://www.data-recovery-software.net/Linux_Recovery.shtml ... Don't
> know if that will work though. If someone can suggest something else...
> Maybe the data is still there but just not accessible via the
> filesystem, how could I go about trying to retrieve it?
>
> Thanks for the suggestions though, at least I'm trying things...
>
> J-S
>
> --
> ___________________________________________
> Jean-Sébastien Guay jean_seb [at] videotron
> http://whitestar02.webhop.org/
>
>
>
> --
> No virus found in this outgoing message.
> Checked by AVG Anti-Virus.
> Version: 7.0.308 / Virus Database: 266.9.15 - Release Date: 2005/04/16
>
> --
> gentoo-alpha [at] gentoo mailing list
>
>

--
gentoo-alpha [at] gentoo mailing list

brianp at spamcop

Apr 17, 2005, 8:48 PM

Post #12 of 15 (1663 views)
Permalink

Re: SOS : All my data is gone! [In reply to]

Another option on the track you are following, with that windows PC and the
SCSI controller, try using the knoppix STD image (all the forensics tools
are on the CD).
www.knoppix-std.org

Which might be easier than trying to build alpha specific versions.

Brian..

----- Original Message -----
From: "Brian Parkhurst" <brianp [at] spamcop>
To: <gentoo-alpha [at] lists>
Sent: Sunday, April 17, 2005 8:36 PM
Subject: Re: [gentoo-alpha] SOS : All my data is gone!

> Just a thought, have you looked into autopsy and the various forensic
> toolkits (e.g. TCT (the coroners toolkit))
> available for linux?
>
> It may be able to recover more of your data. You may need to be able to
> compile them for alpha though.
>
> Brian Parkhurst
>
> ----- Original Message -----
> From: "Jean-Sébastien Guay" <jean_seb [at] videotron>
> To: <gentoo-alpha [at] lists>
> Sent: Sunday, April 17, 2005 7:57 PM
> Subject: Re: [gentoo-alpha] SOS : All my data is gone!
>
>
> > Hello Rikard,
> >
> > >What filesystem are you using?
> > >
> > >
> >
> > I was using ext3.
> >
> > >I had a similar mishap with a reiserfs system loosing all the data on
> > >2x30 GB disks. (both full to about 85%)
> > >It turned out to be a trashed journal that could (to some extent) be
> salvaged
> > >via rescueattempts using the ordinary reiserfs tools.
> > >
> > >
> >
> > When I rebooted with the 2004.3 LiveCD, I ran e2fsck on the drive, and
> > it said my journal was corrupted. It deleted it, and said I needed to
> > run tune2fs -j on the drive again to recreate it. But even after that,
> > the data still seems to be lost (the drive is totally empty).
> >
> > What I think I'll do next is install a SCSI card in a Windows PC I have,
> > and try some recovery tools like for example
> > http://www.data-recovery-software.net/Linux_Recovery.shtml ... Don't
> > know if that will work though. If someone can suggest something else...
> > Maybe the data is still there but just not accessible via the
> > filesystem, how could I go about trying to retrieve it?
> >
> > Thanks for the suggestions though, at least I'm trying things...
> >
> > J-S
> >
> > --
> > ___________________________________________
> > Jean-Sébastien Guay jean_seb [at] videotron
> > http://whitestar02.webhop.org/
> >
> >
> >
> > --
> > No virus found in this outgoing message.
> > Checked by AVG Anti-Virus.
> > Version: 7.0.308 / Virus Database: 266.9.15 - Release Date: 2005/04/16
> >
> > --
> > gentoo-alpha [at] gentoo mailing list
> >
> >
>
> --
> gentoo-alpha [at] gentoo mailing list
>
>

--
gentoo-alpha [at] gentoo mailing list

jean_seb at videotron

Apr 19, 2005, 8:30 AM

Post #13 of 15 (1664 views)
Permalink

Re: SOS : All my data is gone! [In reply to]

Hello Brian,

>Another option on the track you are following, with that windows PC and the
>SCSI controller, try using the knoppix STD image (all the forensics tools
>are on the CD).
>www.knoppix-std.org
>
>Which might be easier than trying to build alpha specific versions.
>
>

Indeed, since the OS was wiped off the drive at the same time as the
rest of my data, it would be pretty hard to compile alpha versions of
the tools right now. Thanks for the suggestion, it's exactly what I
needed. I didn't know what could be used to do data recovery on
EXT2/EXT3 partitions, so your link put me on the right track.

The drive is currently plugged into my Windows box and I'm going to
start trying to recover stuff in a minute. I'll keep you posted.

Thanks again,

J-S

--
___________________________________________
Jean-Sébastien Guay jean_seb [at] videotron
http://whitestar02.webhop.org/

--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.308 / Virus Database: 266.9.17 - Release Date: 2005/04/19

--
gentoo-alpha [at] gentoo mailing list

brianp at spamcop

Apr 19, 2005, 11:46 AM

Post #14 of 15 (1662 views)
Permalink

Re: SOS : All my data is gone! [In reply to]

Hope all goes well.

I used to know that stuff pretty well, but its been a couple of years.
I'd taken the SANS track on Forensics in 2001, and some of the tools
were fairly new then.

Brian Parkhurst
www.pyrobrian.com

On Tue, 2005-04-19 at 11:30 -0400, Jean-Sébastien Guay wrote:
> Hello Brian,
>
> >Another option on the track you are following, with that windows PC and the
> >SCSI controller, try using the knoppix STD image (all the forensics tools
> >are on the CD).
> >www.knoppix-std.org
> >
> >Which might be easier than trying to build alpha specific versions.
> >
> >
>
> Indeed, since the OS was wiped off the drive at the same time as the
> rest of my data, it would be pretty hard to compile alpha versions of
> the tools right now. Thanks for the suggestion, it's exactly what I
> needed. I didn't know what could be used to do data recovery on
> EXT2/EXT3 partitions, so your link put me on the right track.
>
> The drive is currently plugged into my Windows box and I'm going to
> start trying to recover stuff in a minute. I'll keep you posted.
>
> Thanks again,
>
> J-S
>
> --
> ___________________________________________
> Jean-Sébastien Guay jean_seb [at] videotron
> http://whitestar02.webhop.org/
>
>
>
> --
> No virus found in this outgoing message.
> Checked by AVG Anti-Virus.
> Version: 7.0.308 / Virus Database: 266.9.17 - Release Date: 2005/04/19
>

--
gentoo-alpha [at] gentoo mailing list

mxa at xs4all

Apr 20, 2005, 12:31 AM

Post #15 of 15 (1669 views)
Permalink

Re: SOS : All my data is gone! [In reply to]

On Tue, April 19, 2005 17:30, Jean-Sébastien Guay said:
> The drive is currently plugged into my Windows box and I'm going to
> start trying to recover stuff in a minute. I'll keep you posted.

Hi J-S,

Sorry to hear about your problems. Since you've hooked up the drive to an
x86 machine now, you could give the SystemRescueCD a try
(http://www.sysresccd.org/). It's Gentoo-based so it must be good ;-) I
had good results with this one repartitioning my xbox hard drive
(essentially turning it into an ex-box)...

Good luck!

Marnix.

--
gentoo-alpha [at] gentoo mailing list

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads