Re: [vox-tech] Recovering data
I love mc. It is an editor, viewer, directory browser. rsyncer, and many more things. You can even look inside tar and rpm files with it. For some reason, it's always been popular on Europe, but not so much here. On Tue, 2003-03-18 at 23:35, Charles Polisher wrote: Have you checked if ls is correctly reporting the file size? Maybe du / df or some such would help confirm the fire is actually small. Find midnite commander, it has a Linux un-rm feature that rocks. It might already be installed as mc, but you can also find it at http://www.gnome.org/mc/ ___ vox-tech mailing list [EMAIL PROTECTED] http://lists.lugod.org/mailman/listinfo/vox-tech ___ vox-tech mailing list [EMAIL PROTECTED] http://lists.lugod.org/mailman/listinfo/vox-tech
Re: [vox-tech] Recovering data
Problem with mc on this problem was that it hung. I don't know why, but it did hang. Mike - Original Message - From: eric nelson [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, March 19, 2003 7:07 PM Subject: Re: [vox-tech] Recovering data I love mc. It is an editor, viewer, directory browser. rsyncer, and many more things. You can even look inside tar and rpm files with it. For some reason, it's always been popular on Europe, but not so much here. On Tue, 2003-03-18 at 23:35, Charles Polisher wrote: Have you checked if ls is correctly reporting the file size? Maybe du / df or some such would help confirm the fire is actually small. Find midnite commander, it has a Linux un-rm feature that rocks. It might already be installed as mc, but you can also find it at http://www.gnome.org/mc/ ___ vox-tech mailing list [EMAIL PROTECTED] http://lists.lugod.org/mailman/listinfo/vox-tech ___ vox-tech mailing list [EMAIL PROTECTED] http://lists.lugod.org/mailman/listinfo/vox-tech ___ vox-tech mailing list [EMAIL PROTECTED] http://lists.lugod.org/mailman/listinfo/vox-tech
Re: [vox-tech] Recovering data
Michael J Wenk wrote: Problem with mc on this problem was that it hung. I don't know why, but it did hang. mc to system library: hand over another block! System library to disk driver: another block on the double! Disk driver to IDE interface: read block xyz, I'll wait for it! Disk drive to disk driver: I'll have that ready as soon as I detect the needed sector. (sector address smashed). Suddenly, nothing happens. ___ vox-tech mailing list [EMAIL PROTECTED] http://lists.lugod.org/mailman/listinfo/vox-tech
Re: [vox-tech] Recovering data
On Mon, Mar 17, 2003 at 04:30:20PM -0800, Michael J Wenk wrote: The system is running samba 2.2.3a. There is nothing useful that I can see in any samba logs. I did notice something I was unaware of, the laptop that I call buffy was not in my static DHCP table, ie, it is getting various IP addresses and names. I wonder if that could have an effect? It is highly unlikely that the Dynamic IP had anything to do with this. It sounds like the backup software you used overwrote the file, I would recommend checking the timestamp on the tiny file to see when it happened. (after the first restore, or during the second backup, etc). I went thru the filesystem that I stored the backup on and tried to search for the file with debugfs, but either because the file was too large(recover segfaulted on me) or some other reason. Ive tried the tricks I know to recover a file, and have failed, so Ive pretty much given up on my data, but ANY help would be greatly appreciated. It is too late, but unmounting the partition as soon as you realize something is wrong decreases the chance of future file system activity damaging your file data, wherever it is on the filesystem. One problem you may have 'rm file' is very different from 'echo file' in that one unlinks the file so that it's inode is intact but not attached... the echo on the otherhand truncates the file (releasing all the blocks that are part of the inode), and reuses the inode for the new file contents. From what I understand debugfs utils can reattach unlinked inodes, but once the blocks are not recorded as part of an inode, trying to figure out what blocks were part of what file and in what order is kinda tough. If you value the information greatly, doing a lowlevel partition backup (like 'dd if=/dev/hdb1 of=/big_place/hdb1.img' style) then contacting some people doing ext2/3 filesystem development is your best chance. Good Luck, Mike Simons ___ vox-tech mailing list [EMAIL PROTECTED] http://lists.lugod.org/mailman/listinfo/vox-tech
Re: [vox-tech] Recovering data
Have you checked if ls is correctly reporting the file size? Maybe du / df or some such would help confirm the fire is actually small. Find midnite commander, it has a Linux un-rm feature that rocks. It might already be installed as mc, but you can also find it at http://www.gnome.org/mc/ ___ vox-tech mailing list [EMAIL PROTECTED] http://lists.lugod.org/mailman/listinfo/vox-tech
[vox-tech] Recovering data
Hey, I have a problem where I seem to have lost around 10GB of data from a backup of a PC I have. The file was not rm'd. I suspect that the program that wrote it trashed it(I admit Im not totally sure.) What happened was I ran a backup under XP to a netdrive that resides on my linux system. I verfied the data was there and was usable(by doing a small restore.) However, after I rebuilt the machine, that same backup file went from about 10GB down to 20KB. Since I have not written that kinda data to the disk, I suspect that my data is still there, however using debugfs(the trick to getting info back I know) did not work. Does anyone know of any other way to get at that information? Thanks in advance, Mike
Re: [vox-tech] Recovering data
This sounds like one of those problems that depends completely on the smallest details. I think it was Einstein who said a problem cannot be solved at the same level of awareness with which it was created. :-) I don't know if anyone here can help, but if we can you'll have to give more info. Like exactly what was involved in doing the backup and the test restore (Samba?). -- Rod Roark, Sunset Systems http://www.sunsetsystems.com/ Offering preconfigured Linux computers, custom software and remote system administration services. Public Key: http://www.sunsetsystems.com/rodspublickey.asc On Monday 17 March 2003 01:54 pm, Michael J Wenk wrote: Hey, I have a problem where I seem to have lost around 10GB of data from a backup of a PC I have. The file was not rm'd. I suspect that the program that wrote it trashed it(I admit Im not totally sure.) What happened was I ran a backup under XP to a netdrive that resides on my linux system. I verfied the data was there and was usable(by doing a small restore.) However, after I rebuilt the machine, that same backup file went from about 10GB down to 20KB. Since I have not written that kinda data to the disk, I suspect that my data is still there, however using debugfs(the trick to getting info back I know) did not work. Does anyone know of any other way to get at that information? Thanks in advance, Mike ___ vox-tech mailing list [EMAIL PROTECTED] http://lists.lugod.org/mailman/listinfo/vox-tech
Re: [vox-tech] Recovering data
Okay more details. My network has 4 systems on it. The two important systems in this case are praxis and buffy. praxis is a linux system running debian woody(2.4.19 kernel), and buffy is a toshiba laptop running windows XP. I ran a full save backup on buffy using the ntbackup tool that comes with XP. This was run last thurday or friday(I forget which.) The next day I tested restoring a cpl of files from the backup and it worked great. Due to some CD issues, I couldn't do the rebuild restore that day, so I waited until last night. I decided to run an incremental backup, and when the thing thought that EVERY file had changed, I decided well, that's bogus, we'll just go with the full I made before. I also decided to use a different filename for my backup(I checked append to backup as well.) Here's where I made my major error I think, I didn't check to make sure the backup file was still there before I reinstalled. I suspect(not knowing enough about the ntbackup tool, I do not know) that when I ran the incremental, it decided to delete my old backup file. Why it did this, I do not know, nor can I understand why anyone would think the simple change of a filename would mean the old filename was unimportant. Anyways, after I ran the reinstall and added the basic driver packages, I went and lo and behold my backup file was empty. The original name was Jeanette Backup.bkf and the name I chose to make the incremental was Jeanette Backup2.bkf. The system is running samba 2.2.3a. There is nothing useful that I can see in any samba logs. I did notice something I was unaware of, the laptop that I call buffy was not in my static DHCP table, ie, it is getting various IP addresses and names. I wonder if that could have an effect? I went thru the filesystem that I stored the backup on and tried to search for the file with debugfs, but either because the file was too large(recover segfaulted on me) or some other reason. Ive tried the tricks I know to recover a file, and have failed, so Ive pretty much given up on my data, but ANY help would be greatly appreciated. Oh, the laptop XP system did have its latest patches installed(everything on windows update.) My samba uses user authentication, and other than only allowing connections on my local subnet, has no other configuration... Please let me know any other details needed. Thanks in advance, Mike - Original Message - From: Rod Roark [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, March 17, 2003 3:20 PM Subject: Re: [vox-tech] Recovering data This sounds like one of those problems that depends completely on the smallest details. I think it was Einstein who said a problem cannot be solved at the same level of awareness with which it was created. :-) I don't know if anyone here can help, but if we can you'll have to give more info. Like exactly what was involved in doing the backup and the test restore (Samba?). -- Rod Roark, Sunset Systems http://www.sunsetsystems.com/ Offering preconfigured Linux computers, custom software and remote system administration services. Public Key: http://www.sunsetsystems.com/rodspublickey.asc On Monday 17 March 2003 01:54 pm, Michael J Wenk wrote: Hey, I have a problem where I seem to have lost around 10GB of data from a backup of a PC I have. The file was not rm'd. I suspect that the program that wrote it trashed it(I admit Im not totally sure.) What happened was I ran a backup under XP to a netdrive that resides on my linux system. I verfied the data was there and was usable(by doing a small restore.) However, after I rebuilt the machine, that same backup file went from about 10GB down to 20KB. Since I have not written that kinda data to the disk, I suspect that my data is still there, however using debugfs(the trick to getting info back I know) did not work. Does anyone know of any other way to get at that information? Thanks in advance, Mike ___ vox-tech mailing list [EMAIL PROTECTED] http://lists.lugod.org/mailman/listinfo/vox-tech ___ vox-tech mailing list [EMAIL PROTECTED] http://lists.lugod.org/mailman/listinfo/vox-tech
Re: [vox-tech] Recovering data
Others on the list can correct me if I am wrong, but I think the max filesize for ext2 and ext3 is 2GB while for ResierFS is in the Exabytes but since Max block dev size for Linux-2.4 series is 2 Terabytes, this can be an effective limit for all fs under this version kernel. So, if you were using ext2 or ext3, and tried to write an 8GB file via smb service mapped volume to an ext2/ext3 filesystem, it is not clear what would happen without looking at the source. I would *hope* that an error would be returned to smbd during the file write, or an exception would be thrown effecting error control and recovery so that when the write beyond max was being attempted, the error would be passed by smbd to the session to fail the transfer. This being said, I have seen files in ext2 that had reported sizes larger than 2GB, but in all cases where I saw this, the file was damaged and did not really occupy the space stated in the listing. I'm still not usi9ng a current ext3, so if anyone can state with certainty that ext3 can write beyond the 2GB file limit, then they would likely be informing you of what is true now. This is one feature of resierfs that makes it more sexy than ext3 - assuming it is still true. Probably not what you wanted to hear. :-/ If the file was deleted, you can examine using mc (midnight commander) to read the device directly (as root) and try to undelete the lost file. However, last I checked, this was only officially supported for ext2 under mc. :-/ (To make matters worse, i think that mc uses the same effective procedure as debugfs for undelete.) Sorry, hope the news gets better, -ME Michael J Wenk said: Okay more details. My network has 4 systems on it. The two important systems in this case are praxis and buffy. praxis is a linux system running debian woody(2.4.19 kernel), and buffy is a toshiba laptop running windows XP. I ran a full save backup on buffy using the ntbackup tool that comes with XP. This was run last thurday or friday(I forget which.) The next day I tested restoring a cpl of files from the backup and it worked great. Due to some CD issues, I couldn't do the rebuild restore that day, so I waited until last night. I decided to run an incremental backup, and when the thing thought that EVERY file had changed, I decided well, that's bogus, we'll just go with the full I made before. I also decided to use a different filename for my backup(I checked append to backup as well.) Here's where I made my major error I think, I didn't check to make sure the backup file was still there before I reinstalled. I suspect(not knowing enough about the ntbackup tool, I do not know) that when I ran the incremental, it decided to delete my old backup file. Why it did this, I do not know, nor can I understand why anyone would think the simple change of a filename would mean the old filename was unimportant. Anyways, after I ran the reinstall and added the basic driver packages, I went and lo and behold my backup file was empty. The original name was Jeanette Backup.bkf and the name I chose to make the incremental was Jeanette Backup2.bkf. The system is running samba 2.2.3a. There is nothing useful that I can see in any samba logs. I did notice something I was unaware of, the laptop that I call buffy was not in my static DHCP table, ie, it is getting various IP addresses and names. I wonder if that could have an effect? I went thru the filesystem that I stored the backup on and tried to search for the file with debugfs, but either because the file was too large(recover segfaulted on me) or some other reason. Ive tried the tricks I know to recover a file, and have failed, so Ive pretty much given up on my data, but ANY help would be greatly appreciated. Oh, the laptop XP system did have its latest patches installed(everything on windows update.) My samba uses user authentication, and other than only allowing connections on my local subnet, has no other configuration... Please let me know any other details needed. Thanks in advance, Mike - Original Message - From: Rod Roark [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, March 17, 2003 3:20 PM Subject: Re: [vox-tech] Recovering data This sounds like one of those problems that depends completely on the smallest details. I think it was Einstein who said a problem cannot be solved at the same level of awareness with which it was created. :-) I don't know if anyone here can help, but if we can you'll have to give more info. Like exactly what was involved in doing the backup and the test restore (Samba?). On Monday 17 March 2003 01:54 pm, Michael J Wenk wrote: I have a problem where I seem to have lost around 10GB of data from a backup of a PC I have. The file was not rm'd. I suspect that the program that wrote it trashed it(I admit Im not totally sure.) What happened was I ran a backup under XP to a netdrive that resides on my
Re: [vox-tech] Recovering data
Hmm. I have several files that were over 2GB, One around 3GB, and the other is 28GB. Im running ext2 as my filesystem. Ive searched using mc, recover and debugfs, and they can find no trace of my wayward file. I guess I have to give up at this point, though it is painful. Thanks Mike - Original Message - From: ME [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, March 17, 2003 10:59 PM Subject: Re: [vox-tech] Recovering data Others on the list can correct me if I am wrong, but I think the max filesize for ext2 and ext3 is 2GB while for ResierFS is in the Exabytes but since Max block dev size for Linux-2.4 series is 2 Terabytes, this can be an effective limit for all fs under this version kernel. So, if you were using ext2 or ext3, and tried to write an 8GB file via smb service mapped volume to an ext2/ext3 filesystem, it is not clear what would happen without looking at the source. I would *hope* that an error would be returned to smbd during the file write, or an exception would be thrown effecting error control and recovery so that when the write beyond max was being attempted, the error would be passed by smbd to the session to fail the transfer. This being said, I have seen files in ext2 that had reported sizes larger than 2GB, but in all cases where I saw this, the file was damaged and did not really occupy the space stated in the listing. I'm still not usi9ng a current ext3, so if anyone can state with certainty that ext3 can write beyond the 2GB file limit, then they would likely be informing you of what is true now. This is one feature of resierfs that makes it more sexy than ext3 - assuming it is still true. Probably not what you wanted to hear. :-/ If the file was deleted, you can examine using mc (midnight commander) to read the device directly (as root) and try to undelete the lost file. However, last I checked, this was only officially supported for ext2 under mc. :-/ (To make matters worse, i think that mc uses the same effective procedure as debugfs for undelete.) Sorry, hope the news gets better, -ME Michael J Wenk said: Okay more details. My network has 4 systems on it. The two important systems in this case are praxis and buffy. praxis is a linux system running debian woody(2.4.19 kernel), and buffy is a toshiba laptop running windows XP. I ran a full save backup on buffy using the ntbackup tool that comes with XP. This was run last thurday or friday(I forget which.) The next day I tested restoring a cpl of files from the backup and it worked great. Due to some CD issues, I couldn't do the rebuild restore that day, so I waited until last night. I decided to run an incremental backup, and when the thing thought that EVERY file had changed, I decided well, that's bogus, we'll just go with the full I made before. I also decided to use a different filename for my backup(I checked append to backup as well.) Here's where I made my major error I think, I didn't check to make sure the backup file was still there before I reinstalled. I suspect(not knowing enough about the ntbackup tool, I do not know) that when I ran the incremental, it decided to delete my old backup file. Why it did this, I do not know, nor can I understand why anyone would think the simple change of a filename would mean the old filename was unimportant. Anyways, after I ran the reinstall and added the basic driver packages, I went and lo and behold my backup file was empty. The original name was Jeanette Backup.bkf and the name I chose to make the incremental was Jeanette Backup2.bkf. The system is running samba 2.2.3a. There is nothing useful that I can see in any samba logs. I did notice something I was unaware of, the laptop that I call buffy was not in my static DHCP table, ie, it is getting various IP addresses and names. I wonder if that could have an effect? I went thru the filesystem that I stored the backup on and tried to search for the file with debugfs, but either because the file was too large(recover segfaulted on me) or some other reason. Ive tried the tricks I know to recover a file, and have failed, so Ive pretty much given up on my data, but ANY help would be greatly appreciated. Oh, the laptop XP system did have its latest patches installed(everything on windows update.) My samba uses user authentication, and other than only allowing connections on my local subnet, has no other configuration... Please let me know any other details needed. Thanks in advance, Mike - Original Message - From: Rod Roark [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, March 17, 2003 3:20 PM Subject: Re: [vox-tech] Recovering data This sounds like one of those problems that depends completely on the smallest details. I think it was Einstein who said a problem cannot be solved at the same level of awareness
