Hello list, Just to follow up on this. I have tried the tools, especially ext3undel did help in some way. Ext3undel requires some of the tools from sleuthkit. All the tools, sleuthkit, testdisk, ext3del and foremost, did compile quite easy. Just ./configure, make and make install and the tools were available. (Just remember to install requirements like devel-rpm's)
With ext3undel I was able to recover quite a lot of files from the disk. I needed a second disk to hold the files that were recovered, in total close to 2G was recovered. The fragments that were recovered were not saved in their original name. Instead they got, I think, named after the inode. Next I scanned the files with grep for specific words like "kernel:" or the hostname. I was able to find some fragments of a /var/log/messages and several files from the /etc but unfortunatly I only found fragments from November 20th and earlier. Nothing for the 26th. I guess these files are not available anymore, possibly the inodes got reused by some processes that were still running after the filesystem was corrupted. I think we can't recover the files we need to investigate the cause of the problem but it was a nice trip to get to this conclusion :-). Thanks for your help. Regards, Berry. -----Original Message----- From: Linux on 390 Port [mailto:[EMAIL PROTECTED] On Behalf Of Mark Perry Sent: vrijdag 28 november 2008 11:25 To: LINUX-390@VM.MARIST.EDU Subject: Re: Recover a root disk On my x86 RedHat system I have two useful packages: testtool - which supplies photorec - homepage http://www.cgsecurity.org/wiki/TestDisk ext3undel - supplies scripts to recover deleted files via photorec - homepage http://www.izzysoft.de/ Can't see these for s390x, but perhaps now there is a market..... mark ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390 ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390
