Data recovery emergency on a downed server... Help please!!

[Anton Markov]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Madison,

First, if you have a spare hard drive, make a copy of the data on the
bad disk (or better yet two) in case the hardware will die, and work on
the copy.

Then do:

# /sbin/mke2fs -n /dev/hda5 -b [blocksize]
Be sure to use the right block size here!

You will see output including:

Superblock backups stored on blocks:
        8193, 24577, 40961, 57345, 73729
These are the locations of the superblocks.

Pass these one by one to:

e2fsck -b [backup superblock location] -y /dev/hda5

[read up on "man e2fsck"]

If one of these superblocks are OK, e2fsck will start recovering all
possible data (the -y switch means "yes to all"; otherwise you get
thousands of prompts).

All the possible files will be dumped into the /lost+found directory.
- From there, you should be able to do something like:

find /lost+found/* -name [some directory you are sure of the location of]

i.e.
find /long+found/* -name anton
allowed me to find my home directory.

the /lost+found directory basicly contains many hard links to the same
files.

You should be able to find your /home, /var, /etc, or whatever other
directories you have on the drive and move them back to their respective
spot.

Be careful - many files may be corrupt without warning.


Using this technique, I was able to recover an ext3 partition after
deleting it, resizing the partition, reformatting as reiserfs, and using
it for two days.  About 70% of the files got recovered, but it obviously
depends on the damage done.


Madison Kelly wrote:
> That would seem to be the case. However, I have used -many- of these
> Seagates and I have never seen one suddenly pooch before. I am debating
> running the Seagate test on it or decide to just recommend having it sent
> to a data recovery house...
> 
> I know that backups of the superblock are made, do you know by chance how
> to locate them and/or how to tell the OS to use one for mounting? Also, at
> least two partitions on the drive have gone bad...
> 
> Madison
> 
> 

- -- 
Anton Markov <("anton" + "@" + "truxtar" + "." + "com")>

GnuPG Key fingerprint =
5546 A6E2 1FFB 9BB8 15C3  CE34 46B7 8D93 3AD1 44B4

 "The difference between insanity and genius is measured only by success."
 - Some bad guy from 007
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQE/8ESERreNkzrRRLQRAhrqAJ99AdL8vA5Wcqgz/xUbiJIv9xKBtQCfWEc7
vur6ID9kQLMKqte0uPHFRZo=
=/aCT
-----END PGP SIGNATURE-----
--
The Toronto Linux Users Group.      Meetings: http://tlug.ss.org
TLUG requests: Linux topics, No HTML, wrap text below 80 columns
How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml