Dear "misc" list attendees,
maybe someone of you has an idea what happened.
Ten years ago I installed OpenBSD 5.[?] which included setting up a
small partition of 2 GB, including the full OS with kernel, programs,
web-related data, etc.. Occasionally the partition was full so I had to
gzip some logs. Please don't mind that I didn't update the OS - I must
have been very lucky that nothing serious happened, at least I didn't
notice anything suspicious.
What also may be noted is that the ufs magic 0x00011954 (or,
1954 0001, in hexdump switched 2-bytes) was present at position 0x255c
and 0x455c and several times at larger offsets. (very helpful, this
post: https://bugzilla.kernel.org/show_bug.cgi?id=197733; looked
similar to mine few days ago)
This weekend I installed OpenBSD 7.4. (Btw I dislike that the fdisk
"quit" command writes changes, just a side note. Finally I
reconstructed the partition table (fresh MBR pointing to the still
intact disklabel) with the help of GNU/Linux tools i'm familiar with) I
assigned a mount point to the old partition, "/oldbsd5", which worked
on first boot. I just saw the usual files usr, mnt, ... when invoking
"ls /oldbsd5", assumed it was working then. Automatic fstab entry was
[hash].j /oldbsd5 ffs rw,nodev,nosuid 1 2
Then I deleted "rw," from fstab and maybe rebooted the system once or
twice. I'm pretty sure that I never made rm -rf on that directory. Then
I found out (with df -h) that the partition is empty. Really actually
empty, so theres no hidden file, no file, no lost+found, just nothing.
The data, however, is still scattered on disk. I can see the lines of
known text files with grep. I also can see the signature at 0x455c, but
not any more at 0x255c. fsck doesn't find anything problematic.
I have no clue. a) What happened?, b) How easy would it be to get the
data back? (not too important, not my first data loss, but annoying,
anyway)
Best Regards
Jonas
