Arghhhh! All my backup files are gone from USB harddisk

luke sleeman · 10-11-2005, 08:26 AM

Hey,
The other night I decided to install Suse 10.0, upgrading from Suse 9.2. I've borrowed a 200gig usb hard disk to use as a backup for all my files, while I formated my main drive. I pluged in the USB hard disk, and created a Reiser FS partition with YaST and then proceeded to copy all my files across.

After I had formatted and installed Suse 10, I pluged the USB drive back in, fired up konqueror and browsed to the drive via media:/ ... what do you think I saw? Nothing. Absolutely nothing. The whole drive was blank. I even tested to make sure it really was mounted and running, by creating a new empty directory.

Where are my files gone? I've got years worth of photos on there, code for clients, etc, etc.

I've tried mounting the drive manually from the prompt as well as and booting up knoppix, just incase it was a problem with Suse, all to no avail. As far as I can see the partition is there, just totally empty.

please help!

- Luke

Edit - removed 'Arghhhh' from subject. It was anoying me :-)

mgmax · 10-11-2005, 02:59 PM

If its empty, its empty. If not really, you could try to open (for example) /dev/sda1 with a hex editor. and see whether its really zero.

Perhaps you copied them to a local partition only?

Max

luke sleeman · 10-11-2005, 07:18 PM

Hey, thanks for your reply!

I didn't think to look at the actual device to find out if the files really did copy or not. However The USB drive wasn't empty when I formatted it, so unless reiserFS explicitly zeros the partition when you format, then I would presume all I would see in the actuall device is a combination of old and new files, all garbled up.

I'm pretty sure my files are in there somewhere though, because when I copied the light on the USB hard disc was flashing, so it must have been doing something.

luke sleeman · 10-13-2005, 08:11 AM

Hey
I went through my hard disk with a hex editor and the files are definitely there. I can set parts of my source code all chopped up. Does anybody have any suggestions for how I could possibly get them back? I've found a few commercial tools that claim they could get my files back, but forking out $400 USD seems a bit steep to me.

- Luke

luke sleeman · 10-13-2005, 08:48 AM

Ok, I just spent some time looking through the reiserfsck man page. It looks like --rebuild-tree might do what I want, but I have a few questions.

According to the man page --rebuild-tree rebuilds all your directories and files using 'leaf nodes' that it finds on the device. This certainly seems like what I want, because the files are there ... just when I mount the drive I see nothing. I ran reiserfsck --check and it reports:

Code:

No corruptions found
There are on the filesystem:
        Leaves 1
        Internal nodes 0
        Directories 3
        Other files 0
        Data block pointers 0 (0 of them are zero)
        Safe links 0

Now I would imagine that for a full 200gb disk, there should be more than one 'leaf'. When --rebuild-tree says that it will use leaf nodes it finds, does that mean it will only use the 1 leaf node reported by --check, or will it actually scan the device looking for leaf nodes?

Secondly what exactly does the --rebuild-sb option do? When would I use this option? I've googled around looking for explanation of what the superblock in reiserfs is, but I can't find anything very helpful.

- Luke

duffmckagan · 10-13-2005, 08:58 AM

When you copied the files across to your USB Drive for the first time, did you see your files there?

I got no experience with USB hard disks, but usually USB "Keys" have a Read-only - Read-Write Toggle switch.
Not sure if the USB Hard disk have that...but if they have, then it would give you a clue.

Otherwise, it is absolutely wierd to lose files like these I feel.

mimithebrain · 10-13-2005, 10:18 AM

I got a suggestion
Here is what I would do:

dd if=/dev/sda1 of=recover

and then I would open it in kwrite and fetch all the code I can.
About the pictures, you can always try to recover it bit by bit in khexedit... or something similar.

That's the best I can think of right now...

maroonbaboon · 10-13-2005, 06:34 PM

Problem with dd'ing the drive is that you need another 200Gb to store the partition image. Perhaps if data is mainly zeros then piping the output through gzip would reduce it to a manageable size. Then you would have a backup in case you irreversibly screwed up the original drive. I'd experiment first with a smaller partition before relying on this tho'.

A pretty long shot, but there is a perl program called jpg-recover (http://www.clarity.net/~adam/recoverpix.html) which trawls through a disk image trying to find JPEG headers to recover any image files. I think it was written with corrupted flash memory cards in mind, with the simple FAT filesystem. I don't know if it will work on a reiser image.

Does fdisk report the correct partition information?

luke sleeman · 10-13-2005, 07:02 PM

Hey
I'm going to see if I can borrow another 200gig hard drive tonight, because I don't want to be playing with reiserfsck unless I have a backup. The recoverpix program sounds good, but from when I looked through the drive in a hex editor it seems like reiserfs breaks your files up into small chunks and puts them all over the place. This is the problem with pulling out the source code in a text editor as well.

- Luke

maroonbaboon · 10-14-2005, 08:26 AM

Sounds like the best move. Have you checked the mailing lists at www.namesys.com (the reiser home site)? There are a number of discussions about file recovery and use of reiserfsck. e.g. from Feb 2005

reiserfs3 rebuild-tree successful but no files

Site seemed to be down earlier for some reason.

LinuxGeek · 10-14-2005, 08:03 PM

I'm not too familiar with Suse. But since you say that you found the files copied there using a hex editor, perhaps you haven't mounted your usb hard disk and have to mount it. Check to see if it's mounted properly first...

luke sleeman · 10-17-2005, 12:03 AM

Hi

Over the weekend I managed to find a little bit of time to play with it. Unfortunately running rebild-tree didn't do anything for me. I'll try looking through the namesys newsgroups and seeing if I can find anything helpfull.

I'm pretty sure that I've mounted the drive correctly. I tried it across several distributions, even going so far as to try it on my windows box with a few reiserFS programs for windows I found

Thanks for you help!
- Luke

maroonbaboon · 10-18-2005, 07:45 PM

Someone else with SuSE 10 got lost files to reappear by just unplugging/replugging the drive. That was a firewire drive tho'.

luke sleeman · 10-30-2005, 06:16 AM

Hey,
Unfortunately I unpluged and pluged in the drive plenty of times and none of the files reappeared. I've given them up as lost, and there is other data on the drive now. I guess I'll never know what happened. Big thanks to eveybody that tried to help!

- Luke