On Wed, Jan 10, 2024 at 12:21:12AM +0100, Jonas Bechtel wrote:
>
>
> Dear "misc" list attendees,
>
> maybe someone of you has an idea what happened.
>
> Ten years ago I installed OpenBSD 5.[?] which included setting up a
> small partition of 2 GB, including the full OS with kernel, programs,
> web-related data, etc.. Occasionally the partition was full so I had to
> gzip some logs. Please don't mind that I didn't update the OS - I must
> have been very lucky that nothing serious happened, at least I didn't
> notice anything suspicious.
>
> What also may be noted is that the ufs magic 0x00011954 (or,
> 1954 0001, in hexdump switched 2-bytes) was present at position 0x255c
> and 0x455c and several times at larger offsets. (very helpful, this
> post: https://bugzilla.kernel.org/show_bug.cgi?id=197733; looked
> similar to mine few days ago)
>
> This weekend I installed OpenBSD 7.4. (Btw I dislike that the fdisk
> "quit" command writes changes, just a side note. Finally I
> reconstructed the partition table (fresh MBR pointing to the still
> intact disklabel) with the help of GNU/Linux tools i'm familiar with) I
> assigned a mount point to the old partition, "/oldbsd5", which worked
> on first boot. I just saw the usual files usr, mnt, ... when invoking
> "ls /oldbsd5", assumed it was working then. Automatic fstab entry was
>
> [hash].j /oldbsd5 ffs rw,nodev,nosuid 1 2
>
> Then I deleted "rw," from fstab and maybe rebooted the system once or
> twice. I'm pretty sure that I never made rm -rf on that directory. Then
> I found out (with df -h) that the partition is empty. Really actually
> empty, so theres no hidden file, no file, no lost+found, just nothing.
>
> The data, however, is still scattered on disk. I can see the lines of
> known text files with grep. I also can see the signature at 0x455c, but
> not any more at 0x255c. fsck doesn't find anything problematic.
>
>
> I have no clue. a) What happened?, b) How easy would it be to get the
> data back? (not too important, not my first data loss, but annoying,
> anyway)
>
>
>
> Best Regards
> Jonas
Is the disk mounted? I seem to remember a fstab line without rw or ro
is not mounted.
-Otto
