Re: Urgent XFS Recovery
On Mon, Jul 04, 2011 at 10:54:34AM +0300, yazicivo wrote: > Hi, > > I have an XFS partition, which is > > 1) Mistakenly quick formatted as FAT16. 2) At first, I couldn't see > in "fdisk -l" that it is set to FAT16, instead of Linux. Hence tried > to fix it with xfs_recover. xfs_recover returned 0, and mount > operation succeeded; but mounted fs size appeared as 20GB (despite it > is 350GB) and almost every the file is missing. 3) Later set the type > of /dev/sda1 (the only partition in /dev/sda) to Linux, re-run > xfs_recover, but nothing changed. > > I open the system with Knoppix, and below are the details of the > current status. I need urgent help to recover the files. I will be > really, really appreciated for any help! Axel Freyn's suggestion seems good one. Just keep them never written over and save data. When I checked disk recovery tool, I found testdisk package seems very popular and supports XFS. http://packages.debian.org/sid/testdisk See my list of recovery Debian tools: http://www.debian.org/doc/manuals/debian-reference/ch10.en.html#_data_file_recovery_and_forensic_analysis Also, around that section, I have some basic tricks described :-) Good luck, Osamu -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20110705134920.ga7...@debian.org
Re: Urgent XFS Recovery
On Jul 4, 2011 8:34 PM, "Rob Owens" wrote: > > On Mon, Jul 04, 2011 at 12:35:48PM -0700, consul tores wrote: > I've had good luck with photorec, which is part of the testdisk package. > It will find files regardless of the state of your partitions. > Now that is just too cool. The wiki does have a note about not being able to deal with reiserfs, so I'm not sure if xfs is the same. But that tool looks to be too cool for school none the less :) It is possible, if you Google or look around github that you might find a modified version that works with xfs (if the standard version doesn't)... though, just did a quick Google on 'photorec xfs' and it looks pretty promising (though Google it yourself because some pretty cool links popped up). That said, you really do need to do this on a backup because if you fail.
Re: Urgent XFS Recovery
On Mon, Jul 04, 2011 at 12:35:48PM -0700, consul tores wrote: > 2011/7/4 yazicivo : > > Hi, > > > > I have an XFS partition, which is > > I have never used XFS, but it could be helpfull! > > If you use Lilo, then look for mbr copy. > If you are not using Lilo, testdisk could be the appropriated tool. > If nothing help, then you might use a hex editor as shawn mentioned. > I've had good luck with photorec, which is part of the testdisk package. It will find files regardless of the state of your partitions. Make sure you tell it to save your files to a partition other than the one you are trying to recover! -Rob -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20110705002729.ga23...@aurora.owens.net
Re: Urgent XFS Recovery
On 04/07/2011 21:35, consul tores wrote: If you use Lilo, then look for mbr copy. If you backed up your MBR, maybe it's time to recover it (on a copy hard drive as well) to restore the partition table (hope your xfs partition haven't changed too much). Nicolas -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/4e12338d.7050...@yahoo.fr
Re: Urgent XFS Recovery
2011/7/4 yazicivo : > Hi, > > I have an XFS partition, which is I have never used XFS, but it could be helpfull! If you use Lilo, then look for mbr copy. If you are not using Lilo, testdisk could be the appropriated tool. If nothing help, then you might use a hex editor as shawn mentioned. I am assuming that you are playing on a copy of your disk, are you? > > 1) Mistakenly quick formatted as FAT16. > 2) At first, I couldn't see in "fdisk -l" that it is set to FAT16, instead > of Linux. Hence tried to fix it with xfs_recover. xfs_recover returned 0, > and mount operation succeeded; but mounted fs size appeared as 20GB (despite > it is 350GB) and almost every the file is missing. > 3) Later set the type of /dev/sda1 (the only partition in /dev/sda) to > Linux, re-run xfs_recover, but nothing changed. > > I open the system with Knoppix, and below are the details of the current > status. I need urgent help to recover the files. I will be really, really > appreciated for any help! > > Best. You have testdisk on Knoppix, and as somebody said the change could had happened on partitions table only. > > # fdisk -l > > Disk /dev/sda: 320.1 GB, 320072933376 bytes > 255 heads, 63 sectors/track, 38913 cylinders > Units = cylinders of 16065 * 512 = 8225280 bytes > Sector size (logical/physical): 512 bytes / 512 bytes > I/O size (minimum/optimal): 512 bytes / 512 bytes > Disk identifier: 0x447c435f > > Device Boot Start End Blocks Id System > /dev/sda1 * 1 38913 312568641 83 Linux > > > # mount | grep /dev/sda1 > /dev/sda1 on /media/sda1 type xfs (rw,relatime,attr2,noquota) > > > # df -h | grep /dev/sda1 > /dev/sda1 19G 4,2G 15G 23% /media/sda1 -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/cafxkjqnnuquaf+dd4zyeh1qovkacjyhl9wd5guolwdzyhw7...@mail.gmail.com
Re: Urgent XFS Recovery
On Mon, Jul 4, 2011 at 08:01, yazicivo wrote: > On Mon 7/4/2011 2:41 PM, shawn wilson wrote: > Price is fine with me, the problem is that there is no such company I know > of in Turkey. Any suggestions? > maybe here: http://www.werecoverdata.com/AS/Aydin-Turkey/DataRecoveryAydin-Turkey.htm NOTE: i'm not recommending these guys, they're just the first that popped up when i googled 'turkey data recovery'. do some research before you send your data and make a backup before you send it. >> If the data isn't worth money but you'd still like it back ... > > The data is important for me and worths money. > >> Last thing; you probably want to get away from the computer for a bit. If >> you keep at it without a break you'll probably wonder into more stupidity. > > Thanks for your valuable comments, they were full of insight and shed a > thousand suns on the solution. > i would buy two disks (they're cheap and you'll need one anyway to make a backup before sending your data off). then i'd dd a copy over (as someone described). then i'd make a copy on another disk, throw both in a drawer (ie, safe place) and spend a little time (figuring that you will probably fail, i don't know what your time is worth but you might get lucky vs spending money for nothing) trying to recover your data yourself off of another copy of the dd on the same drive (that way, when you mess up you can go back to your original copy on the same drive and you don't touch your original data or the primary backup again). then, once you are done playing, contact a few companies and explain what you did (you might also want to go ahead and recover your history off of one of those dd images for them too). see what they want you to send, if they can quote you a price (a rough price because depending what you did after the format, it might take more or less time), and (depending on your data) what their policy is on retaining and disclosing your data to third parties. per that last statement, i know turkey has some interesting laws on internet and data use. if you don't like this, you might consider sending your data off to another country (germany comes to mind). hth -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/cah_obictoyjo-hxyto7z8+kreiqegymq-_f+4yfu_ufdjcy...@mail.gmail.com
Re: Urgent XFS Recovery
On 04/07/2011 14:37, Axel Freyn wrote: Hi, So, the question is, how much is this data worth to you? If you made a backup before you started playing with it, it might not be more than $500 for a data recovery company to get your stuff back. If you didn't make that post 'oh shit' backup, your chance of recovering yourself went exponentially down and the price of getting someone else to get your stuff went exponentially up. If this is business, its possible your insurance might cover some of the cost (donno). Price is fine with me, the problem is that there is no such company I know of in Turkey. Any suggestions? If the data isn't worth money but you'd still like it back ... The data is important for me and worths money. Just an additional remark: with each time you mount the new partition write-enabled, you decrease the probability to recover your data (as you're going to change the contents of the disk more and more). So: ONLY mount it read-only and the safest thing would be to play only on a copy of the partition: - add another disk with more than 350GB free space (e.g. mounted to /mnt/) - copy your damaged partition there: (but verify twice that /mnt/partition.dd won't be generated on your destroyed partition :-)) dd if=/dev/sda1 of=/mnt/partition.dd - remove /dev/sda from your system ... then, "partition.dd" will be a 350GB file containing all data from your original partition sda1. You can now try to recover data from this file -- without risk to accidentally destroy your original partition. In order to recover the data, you could have a look at the Debian Forensics packages http://qa.debian.org/developer.php?login=forensics-de...@lists.alioth.debian.org however, I don't know which tools are available for XFS, I only tried it for ext2/3 sometimes. Axel This is really a wise approach. Mine was far more insecure but still maybe interesting: since you just (quickly?) formatted to fat16, I think you only modified the partition table. Then, playing with parted, you could delete (i.e. will only delete the partition entry, not its content of course) the partition formatted to fat16 and then ask parted to search for unreferenced partitions. It should find the xfs partition and recreate the correct entry for it in the partition table. Now, it seems you played a lot with your partition and things might be more complicated or might not (maybe you didn't change anything even if the partition was mounted rw, is that possible with xfs?). Nicolas PS: note that I once did this to recover 3 partitions: /, /home and swap and parted wrongly detected swap, it has a 8 byte offset I had to correct by hand, but everything was properly recovered, just double check the results (partition boundaries displayed as bytes or sectors), etc. -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/4e11cdb3.2060...@yahoo.fr
Re: Urgent XFS Recovery
Hi, > > > So, the question is, how much is this data worth to you? If you made a > > backup before you started playing with it, it might not be more than $500 > > for a data recovery company to get your stuff back. If you didn't make that > > post 'oh shit' backup, your chance of recovering yourself went exponentially > > down and the price of getting someone else to get your stuff went > > exponentially up. If this is business, its possible your insurance might > > cover some of the cost (donno). > > Price is fine with me, the problem is that there is no such company I > know of in Turkey. Any suggestions? > > > If the data isn't worth money but you'd still like it back ... > > The data is important for me and worths money. Just an additional remark: with each time you mount the new partition write-enabled, you decrease the probability to recover your data (as you're going to change the contents of the disk more and more). So: ONLY mount it read-only and the safest thing would be to play only on a copy of the partition: - add another disk with more than 350GB free space (e.g. mounted to /mnt/) - copy your damaged partition there: (but verify twice that /mnt/partition.dd won't be generated on your destroyed partition :-)) dd if=/dev/sda1 of=/mnt/partition.dd - remove /dev/sda from your system ... then, "partition.dd" will be a 350GB file containing all data from your original partition sda1. You can now try to recover data from this file -- without risk to accidentally destroy your original partition. In order to recover the data, you could have a look at the Debian Forensics packages http://qa.debian.org/developer.php?login=forensics-de...@lists.alioth.debian.org however, I don't know which tools are available for XFS, I only tried it for ext2/3 sometimes. Axel -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20110704123740.GA25392@axel
RE: Urgent XFS Recovery
On Mon 7/4/2011 2:41 PM, shawn wilson wrote: > So, you didn't mention your backup policy. I'm guessing this means you had > none? I had one, but it was damaged 2 days before the original fs crash. Moreover, if I would have one, I wouldn't be bugging you right now. > So, the question is, how much is this data worth to you? If you made a > backup before you started playing with it, it might not be more than $500 > for a data recovery company to get your stuff back. If you didn't make that > post 'oh shit' backup, your chance of recovering yourself went exponentially > down and the price of getting someone else to get your stuff went > exponentially up. If this is business, its possible your insurance might > cover some of the cost (donno). Price is fine with me, the problem is that there is no such company I know of in Turkey. Any suggestions? > If the data isn't worth money but you'd still like it back ... The data is important for me and worths money. > Last thing; you probably want to get away from the computer for a bit. If > you keep at it without a break you'll probably wonder into more stupidity. Thanks for your valuable comments, they were full of insight and shed a thousand suns on the solution. Best.
Re: Urgent XFS Recovery
So, you didn't mention your backup policy. I'm guessing this means you had none? So, the question is, how much is this data worth to you? If you made a backup before you started playing with it, it might not be more than $500 for a data recovery company to get your stuff back. If you didn't make that post 'oh shit' backup, your chance of recovering yourself went exponentially down and the price of getting someone else to get your stuff went exponentially up. If this is business, its possible your insurance might cover some of the cost (donno). If the data isn't worth money but you'd still like it back (and you didn't make the 'post oh shit' backup) you need to do that before going in any direction. Then, I'd find a hex editor I really liked and sit down with the Google and read on what xfs partitions look like (probably creating a 500k file with xfs on it, mount it, echo "hello world"> test, unmount and see what it looks like), after that, do your quick format and see what changed (diff). Last thing; you probably want to get away from the computer for a bit. If you keep at it without a break you'll probably wonder into more stupidity.
