LinuxQuestions.org
LinuxAnswers - the LQ Linux tutorial section.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices

Reply
 
Search this Thread
Old 05-18-2008, 11:05 PM   #1
IronHelix
LQ Newbie
 
Registered: May 2008
Posts: 3

Rep: Reputation: 0
Angry Need to recover ext3 filesystem- MBR and LVM are gone :(


Hi all,

I have a sort of unusual problem. I have a Linux box (centos or fedora, forget which, left it alone for a good long time) that used to be a minor server. Its HDD started making a funny noise so i decided to move it to a new box and DD the disk over in the process. I cleaned out the box and attached the currently working drive as slave (hdb), new drive as master (hda)

helpful tip- it is probably a good idea to read your DD command at least 2-3 times before you hit enter.

After zeroing the 'new' drive with dd if=/dev/zero of=/dev/hda, I then went to DD the data from old drive to new. Except it was 3am, and by accident i started the zeroed drive DDing onto my good drive. I noticed the error and killed it after around 10 seconds, but the MBR, partition table, etc was all gone.


*as I recall*, /boot was either 512mb or 1gb, followed by my ext3 / partition, followed by a swap partition. Considering this was a really old 10gb HDD, I doubt that I managed to eat up the beginning of the / partition.

I've ran gpart and testdisk on the drive, no luck.

I'm guessing that it was partitioned using LVM and that might be why... honestly i don't remember as I put the thing together 2 years ago and haven't looked at it much since.


After this whole thing, I DD'd the (now screwed up) drive to an image file and i've been working on that so far... my current thread is a program called PhotoRec that goes through your drive and looks for files, then dumps them all into a folder with no names, only guesses at types. As you can imagine this takes a long time. It's done at the moment, doing the 'brute force' scan now and grepping through its output reveals what look like fragments of my files but nothing too useful., namely the particular files I need.


So my question...

Assuming my bad DD didn't nuke the beginning of / and the resulting file system...
what could I use to try and find the beginning of the / partition? Assuming it's LVM, how might I rebuild the LVM and get the partition back?

And/or is there any better idea that I should try?
 
Old 05-19-2008, 12:30 AM   #2
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 12,096

Rep: Reputation: 979Reputation: 979Reputation: 979Reputation: 979Reputation: 979Reputation: 979Reputation: 979Reputation: 979
No-one has a /boot that big - 100 Meg is generally considered over-kill. I'd say that was the size of your swap.
If testdisk didn't find the (root) partition, you've trampled on (at least the start of) it. Current testdisk versions are even LVM aware.
I'd say you are out of luck - all the filesystem metadata will be gone.

Normally I'd advise photorec then some forensic software like foremost.

I get pretty anal about backups - especially when screwing around with partitions at 03:00
 
Old 05-19-2008, 02:54 AM   #3
IronHelix
LQ Newbie
 
Registered: May 2008
Posts: 3

Original Poster
Rep: Reputation: 0
i vaguely remember configuring a 512mb /boot partition. I agree there is little need for that much space and I have no idea why I did it, but I'm pretty sure I did. Or perhaps not...

As for backups I have one but it's really old. I coulda sworn I made one more recently but i can't seem to find it. I suspect a small shell script CRON'd to tar up the important stuff and upload it somewhere else is in my future...


Last question, i don't know much about ext3 filesystems but as i understand it metadata is stored in one or more superblocks which can be scattered around the FS. If I found one, would it do me any good / is there any tool I could use to recover data using it? I think photorec is capable of looking for them, perhaps one is in the 100k files it spat out... *shrug*
 
Old 05-19-2008, 03:14 AM   #4
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 12,096

Rep: Reputation: 979Reputation: 979Reputation: 979Reputation: 979Reputation: 979Reputation: 979Reputation: 979Reputation: 979
Check on the "-S" option of mkfs.ext3
Read the warnings particularly.

Edit: you would (of course) need to know where the partition started to even contemplate this.

Last edited by syg00; 05-19-2008 at 03:21 AM.
 
  


Reply

Tags
data, ext3, lvm, recover, recovery


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Recover deleted files from ext3 filesystem digdogger Linux - Software 11 10-01-2007 10:26 AM
Assistance using fsck to recover ext3 LVM partition fiberfarm Fedora 1 11-01-2006 08:49 PM
How to recover a deleted file from ext3 filesystem ? Honor Linux - Software 1 12-21-2005 12:36 PM
Trying to recover files with ext3 filesystem bgenora Linux - Newbie 1 11-07-2005 11:54 AM
Reformatted ext3 filesystem - recover? addy86 Linux - General 11 01-10-2005 12:49 AM


All times are GMT -5. The time now is 05:50 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration